Skip to main content

An AI Assistant for Administration

Duration20 minLevelAdvancedOfferModule IntégrationPrerequisitesAPI and webhooks

Objectives​

0 / 3 objectives achieved — check them off as you go through the lesson.

Why It's Useful​

“Create an account for Marie, send her the invitation, and give her access to the Accounting folder.” The MCP server of VaultysHub allows an AI assistant to execute this kind of request. It does not add any rights: each tool calls the API with the same controls and the same traceability. Therefore, the assistant can do nothing more than its key allows.

Your Turn​

  1. In Configuration, tab MCP, enable Enable MCP Server, then create an MCP key named “AI Assistant — test” with Read-only access. → MCP Server
  2. In the MCP Server for AI Agents block, click on Copy URL. The address is that of your VaultysHub followed by /api/workflow/mcp.
  3. Connect your assistant by following the example on the manual page (Claude Code, Cursor, VS Code, or Claude Desktop). With Claude Code, Copy Claude Code Command provides a ready-to-paste command.
  4. Ask: “List the members who have not yet completed their registration.”
  5. Then ask to create a user: the tool is not offered because the key is read-only. Add the Users: read and write right to the key (menu ⋮, Edit) and try again.
  6. If your organization has the Compliance module, open the audit log: the creation appears there under the key name.
  7. Revoke the key at the end of the exercise.
danger

Anyone or any assistant holding the key has its rights. Never publish it in a code repository. Review the actions proposed by the assistant before validating them, especially deletions and role changes.

Check Your Knowledge​

1What rights does the assistant connected to the MCP server have?
2The assistant receives a 401 error upon connection. What could be the cause?
3You no longer use the assistant, but your integrations still use the API. What should you do?

Key Takeaways​

  • The MCP server is at the address of your VaultysHub, followed by /api/workflow/mcp.
  • The MCP server has its own keys (mcp_…), managed in the MCP tab: an API key is refused there.
  • One key per assistant, with the minimum rights; read-only is sufficient for querying.
  • Everything the assistant does is tracked under the name of its key.

Last step: Module Summary