01 · Password
The documented grant sends the password
The password grant is how the guide obtains the first token. After that, refresh is the call. A connector that keeps posting the password has copied the example, not the session.
For sales teams on SugarCRM
A SugarCRM MCP server reads opportunities and accounts from the REST API whose version matches the Sugar release. Sugar does not ship an MCP server as of 6 October 2026. The documented login is a password grant. Pexon exchanges that once for a refresh token and does not create records.
What we build
Built on what SugarCRM documents: Accounts, Contacts, Opportunities, Calls, Meetings, Tasks, Quotes. Backends named below are documented resources; "confirmed in blueprint" means the vendor documentation sits behind a login and the resource is checked against your release first.
# sugarcrm-mcp-server: tool manifest, draft for blueprint week 1
# Every tool runs as the person asking. Nothing is written without a person confirming.
tools:
list_my_opportunities: # user -> open opportunities
backend: GET /Opportunities with a filter on assigned user
mode: read
get_opportunity: # id -> amount, sales stage, account
backend: GET /Opportunities/{id}
mode: read
get_account: # id -> name and related contacts
backend: GET /Accounts/{id}
mode: read
list_meetings: # opportunity -> meetings
backend: the meetings link on that record, confirmed in blueprint
mode: read
draft_note: # opportunity, text -> a note a person saves
backend: not posted by the agent
mode: propose
audit: every call logged with user, tool, arguments and the SugarCRM responseThe manifest is the contract. A question that needs an operation not on it gets a new line and a review, not a wider permission.
Checked 6 October 2026
| What we found | |
|---|---|
| Interfaces | Sugar REST API (REST/JSON, docs public) |
| Authentication | Sugar documents a password grant: POST /oauth2/token with the user name and password, client_id sugar, and a platform other than base or mobile so the session does not collide with the UI. The response includes a refresh token. Sending the password on every answer is not the design. The blueprint stores the refresh token for that user. |
| Vendor MCP server | No vendor server. No SugarCRM MCP server is described on the REST guide read on 6 October 2026. |
| Vendor AI assistant | None found. |
| Other connectors | None found. |
SugarCRM (US). B2B teams on Sugar, including the DACH partner channel. The DACH overview of 14 May 2026 lists more than 5,000 customers and a Munich presence. It also names SugarPredict as Sugar's predictive feature. That name is not re-checked on a Sugar product page here.
Why SugarCRM is hard for agents
01 · Password
The password grant is how the guide obtains the first token. After that, refresh is the call. A connector that keeps posting the password has copied the example, not the session.
02 · Platform
Sugar says a platform of base or mobile can conflict with a person logging into the product. The agent uses a dedicated platform value registered for it.
03 · Version
25.1 is v11_26. An older site is an older path. The blueprint reads the version from the instance rather than hard-coding v11.
04 · Admin
The guide documents an endpoint that issues a token as another user, and it requires an admin. That endpoint is not a convenience. It is out of the tool list.
SugarCRM holds the records. An assistant without a governed way in answers from whatever someone pasted into the chat. The connector is the governed way in: named operations, the person's own permissions, every call logged.
When this is the wrong page
SugarPredict, if you bought it, is Sugar's forecast. This page does not repeat an accuracy figure, because the DACH overview only names the product. An agent that re-forecasts the quarter is a second model.
Two weeks, €4,900 fixed price. Week one agrees the tool list with your SugarCRM owners and checks every backend against your release and licence. Week two tests whether a person's own SugarCRM permissions reach through the connector. You keep the manifest and a costed build plan, whoever builds it. All prices are net and exclude VAT.
What we need from you: a named SugarCRM administrator, a test or sandbox system we may call, and one business owner who can say which questions the assistant should answer first. The first production connector is usually a use-case pilot from €15,000; it runs in your environment, and the code is yours.
No SugarCRM MCP server is described on the REST guide read on 6 October 2026. This page describes what we add around that fact: a signed tool list and a test that the asking user only sees their own records.
Not on the list we sign. The blueprint starts read-only. A draft the person saves in the CRM is the only write, and only after that is agreed.
Only where the CRM would already show both of them the same records. Calls run as the person who asked. The blueprint tests that with two users before anything is called production.
The two-week Readiness Blueprint is fixed at €4,900: the tool list, a check against your tenant, and a test that permissions survive the round trip. A production connector is usually a use-case pilot from €15,000. Prices are net, excluding VAT.
Next step
Thirty minutes with the engineer who would build the connector, with your SugarCRM administrator in the room if you like.