01 · Endpoints
There is no fixed opportunity URL
You create each REST endpoint and pick the table, the filter and the methods. A tool named get_opportunity does not exist until that endpoint exists on this database.
For sales teams in production companies on cobra CRM
A cobra CRM MCP server reads the REST endpoints an administrator created in CXM WEB CONNECT. Those ship with CRM PLUS, PRO XL and BI from January 2023. cobra does not ship an MCP server as of 6 October 2026. Login is a JWT for a person. Pexon does not add POST or DELETE.
Why cobra CRM is hard for agents
01 · Endpoints
You create each REST endpoint and pick the table, the filter and the methods. A tool named get_opportunity does not exist until that endpoint exists on this database.
02 · Edition
The overview says the three REST endpoints ship with CRM PLUS, CRM PRO XL and CRM BI from January 2023. A smaller edition is not assumed to have them.
03 · Token
The docs say the token has a lifetime and must be requested again. A shared technical user behind that token is still one person. The blueprint binds the call to the seller.
04 · Cloud
The cloud portal is OAuth and a tenant. WEB CONNECT is a service on the database. Mixing the two in one tool list is how a contact from the wrong tenant gets into an answer.
Checked 6 October 2026
| What we found | |
|---|---|
| Interfaces | CXM WEB CONNECT (REST, docs public) · cobra CRM Cloud API (REST and GraphQL, docs public) |
| Authentication | WEB CONNECT recommends a JWT. The client POSTs user name and password to /api/token with an API key, then sends the key and the token on later calls. Basic auth is documented for tests. Cloud login is OAuth, described on the developer portal. |
| Vendor MCP server | No vendor server. No cobra MCP server is described on the WEB CONNECT docs or the cloud developer portal pages read on 6 October 2026. |
| Vendor AI assistant | None found. |
| Other connectors | None found. |
cobra computer's brainware GmbH (DE). KMU and Mittelstand in DACH, on-premise or cloud. The DACH overview of 14 May 2026 lists cobra CRM at more than 18,000 customers, owner-managed in Konstanz since 1985.
What we build
Built on what cobra computer's brainware GmbH documents: the tables you expose as endpoints, users on the cloud portal, addresses where a business-card endpoint is enabled. Backends named below are documented resources; "confirmed in blueprint" means the vendor documentation sits behind a login and the resource is checked against your release first.
# cobra-crm-mcp-server: tool manifest, draft for blueprint week 1
# Every tool runs as the person asking. Nothing is written without a person confirming.
tools:
list_endpoint: # endpoint name -> rows that endpoint's filter allows
backend: the WEB CONNECT route configured for that table, GET only
mode: read
get_record: # endpoint, id -> one row
backend: GET on that endpoint, confirmed in blueprint
mode: read
whoami: # token -> the cobra user the token belongs to
backend: POST /api/token identity, confirmed in blueprint
mode: read
list_cloud_users: # tenant -> users the cloud portal returns
backend: cloud API, only when this tenant is cloud
mode: read
draft_note: # record, text -> a note a person saves in cobra
backend: not posted by the agent
mode: propose
audit: every call logged with user, tool, arguments and the cobra CRM responseThe manifest is the contract. A question that needs an operation not on it gets a new line and a review, not a wider permission.
One interface per row
01
REST. Documentation is public. included in CRM PLUS, CRM PRO XL and CRM BI since January 2023. Each endpoint is created against one database table, with GET, POST, PUT or DELETE chosen at setup, plus an optional filter
02
REST and GraphQL. Documentation is public. the developer portal documents OAuth login and a tenant context. The object names for a sales question are confirmed on that tenant in the blueprint, not assumed from the on-premise tables
cobra CRM holds the records. An assistant without a governed way in answers from whatever someone pasted into the chat. The connector is the governed way in: named operations, the person's own permissions, every call logged.
When this is the wrong page
If the administrator has not created a single WEB CONNECT endpoint, there is nothing to connect yet. Create the read endpoint for the one table the seller asks about, then build the tool. Do not start from a guessed URL.
Two weeks, €4,900 fixed price. Week one agrees the tool list with your cobra CRM owners and checks every backend against your release and licence. Week two tests whether a person's own cobra CRM permissions reach through the connector. You keep the manifest and a costed build plan, whoever builds it. All prices are net and exclude VAT.
What we need from you: a named cobra CRM administrator, a test or sandbox system we may call, and one business owner who can say which questions the assistant should answer first. The first production connector is usually a use-case pilot from €15,000; it runs in your environment, and the code is yours.
No cobra MCP server is described on the WEB CONNECT docs or the cloud developer portal pages read on 6 October 2026. This page describes what we add around that fact: a signed tool list and a test that the asking user only sees their own records.
Not on the list we sign. The blueprint starts read-only. A draft the person saves in the CRM is the only write, and only after that is agreed.
Only where the CRM would already show both of them the same records. Calls run as the person who asked. The blueprint tests that with two users before anything is called production.
The two-week Readiness Blueprint is fixed at €4,900: the tool list, a check against your tenant, and a test that permissions survive the round trip. A production connector is usually a use-case pilot from €15,000. Prices are net, excluding VAT.
Next step
Thirty minutes with the engineer who would build the connector, with your cobra CRM administrator in the room if you like.