Connect an AI assistant to Breeze
Breeze includes a built-in Model Context Protocol (MCP) server, so you can connect an AI assistant straight to your Breeze account — Claude, ChatGPT, or any other MCP-compatible client. Once connected, you can ask it to look up Tenants, users, Credentials, orders, and products instead of clicking through the portal yourself.
The connection runs entirely under your own Breeze account. The assistant signs in as you, not as a shared service account, and every lookup goes through the same authorization checks as the portal. If something wouldn't show up for you there, it won't show up here either — and nothing the assistant does through this connection can create, change, or delete data. It's read-only.
Your organization must enable MCP access
Connecting an assistant is off by default, and it takes two deliberate steps to turn on — one at each level of your organization.
- A Domain administrator enables MCP for the Domain, under Domain administration → the Domain → Change features → MCP / AI assistant access. This is off for every Domain to begin with, and it's the decision that says assistant connections are permitted under your contract at all. Until it's on, nobody in any Tenant in that Domain can connect an assistant, and the Tenant-level setting isn't even shown.
- A Tenant administrator with the Super Administrator role turns on AI assistant access for the Tenant, under Tenant settings → Security. This setting only appears once the Domain allows it. Each Tenant opts in separately, so enabling the Domain doesn't switch anything on by itself.
The Domain always wins: if a Domain administrator later switches MCP off, every Tenant in it loses access and the Tenant setting disappears again, whatever those Tenants had chosen. New connection attempts are blocked right away; an assistant that's already connected may keep working for about a minute, since each Breeze server briefly caches an active connection.
If the consent screen tells you MCP access is not enabled, or approving sends you back to your assistant with an access_denied error, ask a Tenant administrator to turn on AI assistants (MCP) in Tenant settings → Security. If that setting isn't there at all, MCP hasn't been enabled for your Domain — ask a Domain administrator to turn it on. If you belong to more than one Tenant, switch to the Tenant where MCP is enabled in the portal and start the connection flow again.
Turning access on or off never touches existing connections' consent — you don't have to approve access again once your Tenant is enabled. Some assistants may still ask you to reconnect if they dropped the connection while it was switched off.
Connecting your assistant to Breeze
Any signed-in Breeze user can set this up — there's no special role required to grant the connection itself. What the assistant can see afterward still depends entirely on your own roles.
- In your assistant, add a custom connector and point it at your Breeze backend's MCP address:
https://<your-backend-domain>/mcp(for example,https://system.idportal.no/mcpin production). - The assistant reads Breeze's sign-in configuration directly from that address. There's nothing else to set up on your end.
- You're sent to Breeze to sign in, if you aren't already, and then to a consent screen showing what the connector is asking for. It names the application that's asking and the address your access will be sent to.
- Check that the name and the address match the connector you just set up, then approve. The assistant can now use the connector under your account.
Breeze does not vet connector names — anyone can register one, with any name. Only approve a request you started yourself, and if a consent screen appears unprompted, or names something you don't recognize, deny it.
Where you add a connector differs from product to product. Look for Connectors, Custom connector, or MCP server in your assistant's settings, and expect the exact menu names to vary between Claude, ChatGPT, and everything else. Some products offer custom connectors only on paid or business plans.
What your assistant needs
Any assistant that can reach a remote MCP server and sign you in will work. Breeze registers the connection itself, so the address is the only thing you copy over: no client ID, no secret, no key to paste.
Breeze uses Streamable HTTP, the current MCP connection method. An older client that speaks only the earlier SSE method can't connect, and reports an error rather than falling back.
What the tools can do
Breeze exposes up to 14 tools — the exact list depends on your roles, so you only ever see what you can actually use. An administrator gets the search tools; someone with only the standard user role won't be offered them at all, and the assistant will tell you which role is missing rather than failing halfway. Two tools are worth knowing well for support work: search_users checks every Tenant you can access in a single call when you omit tenant_id, and search_tenants already searches your entire accessible Tenant tree — at any depth — in one call. Both mean you don't have to know where to look before you ask.
| Tool | What it answers |
|---|---|
whoami | Who am I signed in as, and which Tenants can I access? |
search_tenants | Find a Tenant by name anywhere in your accessible Tenant tree, at any depth, in one call. |
get_tenant | Full details for one Tenant, including its parent and sub-Tenants. |
search_users | Find users by name, email, or status. Omit the Tenant to check every Tenant you can access at once. |
get_user | Full profile for one user: roles, groups, and Tenant memberships. |
search_credentials | Search Credentials on a Tenant by name, number, status, or template. |
get_credential | Full detail for one Credential, including production and order information. |
search_orders | Search orders by number, reference, status, or creator — across every Tenant you can reach, or one Tenant if you name it. Asking for an order number finds it whatever state it's in, including open and cancelled. |
get_order | Full detail for one order, including who submitted it and who cancelled, shipped or invoiced it. |
list_products | The product catalog available to your Domain. |
get_product | Full detail for one product. |
search_schema | Reference documentation describing what run_query can ask for. |
run_query | Runs any other read-only Breeze query your roles allow, for the rare case the tools above don't cover. |
breeze_terms | Explains Breeze terminology in English, Norwegian and Swedish, and what any Breeze role permits. Ask "hva er en ID-bærer?" and the assistant resolves it to Credential. |
Every tool runs under your own roles. A search that would return nothing in the portal returns nothing here, too. The assistant is also told what Breeze is and which roles you hold when it connects, so it understands Tenants, Credentials and orders without being explained them each time.
What it cannot do
- No writes, at any layer. The tool list has no create, update, or delete tools — there's nothing to call that would change data.
run_query, the one flexible tool, only accepts a single read operation, draws from a fixed list of queries, and limits how deeply a request can nest. On top of both, Breeze's API independently refuses any write attempt coming from an AI-assistant connection the moment it evaluates the request — so even a bug in a future tool couldn't slip a change through. - No access beyond your roles. The connection sees exactly what your Breeze account sees in the portal. It cannot reach another Tenant, another user's private details, or anything else your roles don't already permit.
Where your data goes
Everything the assistant reads through this connection leaves Breeze and goes to the assistant and the company that operates it. What happens to it there — how long it is kept, who can see it, whether it is used to train models — is decided by that company's terms and your organization's agreement with them.
Sotera's data processing agreement covers data inside Breeze. It does not cover what an AI assistant or its provider does with data after the assistant retrieves it on your behalf. Connecting an assistant is your decision, made under your organization's responsibility — not Sotera's.
Before you connect, check that your organization allows the assistant for work data, and that your assistant account is set up the way your organization requires — for example, a workspace plan where conversations are excluded from model training, rather than a private account.
The consent screen repeats this notice every time a new application asks for access, so the choice is always made knowingly.
Revoking access
Open your User account page, go to Connected apps, and select Revoke access next to the connector.
Revocation isn't instant — each Breeze server briefly caches an active connection, so it takes effect within about a minute rather than immediately.
Usage limits
- 60 requests per minute per user by default. Your Breeze operator can adjust this for your deployment.
- 50,000 characters per response. A result that would exceed this tells you to narrow your filters instead of silently cutting off data.
- Results are paginated. Search tools return one page at a time — ask for the next page rather than expecting a single call to return everything.
- 100 rows per request, at most. Searches have to say how many rows they want, and can't ask for more than a hundred at a time. The assistant handles this for you; it's what stops a broad question from trying to pull an entire Tenant tree in one go.
Learn more
- OAuth API Authentication — the separate, server-to-server OAuth flow for integrations that don't have a person signing in
- Integrations overview