Your SAGARIS CRM and Brain, in your AI assistant

Your assistant reads the real record

Model Context Protocol is an open standard. It hands an AI client a set of tools it can call. SAGARIS runs the server half at /api/v1/mcp, over Streamable HTTP in stateless JSON mode. That means one JSON-RPC message per POST, one JSON response back, and no session to open or close. Connecting a client is one short piece of configuration: the endpoint URL and your API key.

So the assistant your team already works in can ask your workspace a question and get the answer from the record itself. No more pasting a stale export into a chat window and hoping it is current. Your pipeline stays where it lives, and your people read it where they already work.

Your revenue data becomes something the assistant can call, not something a person has to go and look up.

Safe to connect on day one

Choose the permissions your assistant needs. The tool list is derived from the public API and the Brain's read views, and filtered by your key's scopes. CRM, sequences and Brain tools read the record; they cannot edit contacts, dial or enroll people. LinkedIn execution is a separate, explicit permission, not something a read-only key inherits.

Social checklist writes hand you work. A post the assistant drafts waits in your Social review queue until a person approves it. A document, such as a voice guide or a profile rewrite, arrives as an approval card: approve it, ask for a change, or deny it. On a few research items, such as a knowledge panel check or the weekly read, it can record what it found, marked as the assistant's and never over what your team recorded. Each of those needs its own scope on the key.

With linkedin.execute, a connected external agent can claim and start a LinkedIn action only when execution is explicitly activated, a person approved the action or set its account to run automatically, and sender, campaign, safety and quota checks pass. The external agent acts in its LinkedIn session and reports the outcome; SAGARIS does not host that browser session. SAGARIS logs a reported send on the contact and moves its LinkedIn status forward. The API key alone does not establish a LinkedIn login or turn on execution. With MCP Events, a client that takes webhooks, such as a ChatGPT Dot, subscribes to linkedin.work.available, linkedin.schedule.changed and linkedin.reconnect.requested and is told when to act, in ids, counts and the account's label in SAGARIS, never a contact's name, a profile URL or message copy.

Read tools identify themselves as read only. Checklist writes and LinkedIn execution are marked as writes, and execution carries a destructive-action hint because an external message cannot be taken back.

Read access, draft preparation and LinkedIn execution are separate permissions. Grant only the work your assistant should perform.

You decide what each key can see

It uses the workspace API key you already create in settings, sent as a bearer token. Three things follow, and all three are enforced in code rather than written in a policy:

• The key names the workspace. A client never gets to pick one, so it only ever reaches yours.
• Scopes filter the tool list before the client sees it. A tool your key does not cover is never offered at all. That is the version an assistant handles cleanly.
• Every message needs a valid key, the opening handshake included. There is no step where the server talks to a stranger.

Requests are rate limited per key, and a browser client has its origin checked before anything else happens. Revoke the key in settings and the access ends. That is the part you want on the day somebody leaves the team.

You choose what leaves the workspace

The Brain holds more kinds of record than this endpoint hands out, and every one of those calls was made on purpose. Internal delivery commitments, the record of what your own team promised a customer, stay inside the workspace. So does machine-derived competitor intelligence, which only reads properly next to its source and its date. Your most sensitive context stays where you can see who touched it.

The list of subject types this endpoint can read is compiled from the same table the runtime check uses. So this page and the product cannot drift apart. Add a new kind of subject and the build stops until someone decides, on purpose, whether an outside client should see it.

Included in your seat

Nothing beyond the seat. SAGARIS is $499 per seat per month on the founding price, every module and every agent included, with no seat minimum. The endpoint ships with the product rather than in a tier above it, and tool calls are not metered.