Fulcrum MCP & AI Toolkit (Alpha)

📘

Status: Alpha

Early release, still in progress. No API stability guarantees yet. Expect breaking changes before general availability. Feedback: [email protected].

This page is the developer reference for Fulcrum MCP and the Fulcrum AI Toolkit. For a setup walkthrough aimed at non-technical users, see the Fulcrum MCP & AI Toolkit (Alpha) help article.

Overview

Fulcrum MCP is an MCP server that lets any MCP-compatible client (Claude, ChatGPT, Copilot, custom agents, etc.) build and manage Fulcrum apps and query live data.

The Fulcrum AI Toolkit is a library of skills (prompt-level guidance), not a server. It teaches a client Fulcrum's platform conventions (field types, safe automation patterns, what to flag) so it uses the MCP tools correctly. The Toolkit currently does not bundle or configure any MCP server itself; its mcp.json is intentionally empty.

The two can be installed and operated independently, but are meant to be used together.

Endpoints

One endpoint per region. Use the endpoint that matches your organization's Fulcrum instance, not your physical location. There is no automatic fallback between regions.

This is the unified endpoint that exposes both App MCP and Query MCP tools (see Tools below).

Transport & protocol

Streamable HTTP, JSON-RPC 2.0. Standard MCP lifecycle:

initialize → notifications/initialized → tools/list / tools/call

Auth

Fulcrum MCP supports OAuth 2.0 sign-in and API tokens. Use OAuth sign-in when your client supports it. If using a Bearer token, we recommend switching to this OAuth setup.

OAuth sign-in

1. Discovery: The client discovers the authorization server from the MCP endpoint using standard MCP authorization discovery.
2. Client identification: The client identifies itself using a Client ID Metadata Document. Its client ID is the HTTPS URL of its JSON metadata document. No pre-registration with Fulcrum is needed. For example, VS Code uses https://vscode.dev/oauth/client-metadata.json.
3. Login: The user signs in with their normal Fulcrum login, including SAML single sign-on.
4. Consent: The consent page shows the requesting client name and the organization, with Allow access and Deny access buttons. Allow access authorizes the client for what the signed-in member is permitted to access. Deny access returns an access denied response to the client and issues no token.
5. Token: Fulcrum issues short-lived access tokens and forwards them to the underlying App MCP and Query MCP services.

API token

Existing API token connections continue to work and need no changes.

Generate an API token from your Fulcrum account.

Authorization: Bearer YOUR_FULCRUM_API_TOKEN

Minimal config example:

{
  "mcpServers": {
    "fulcrum": {
      "url": "https://mcp.fulcrumapp.com",
      "headers": { "Authorization": "Bearer YOUR_FULCRUM_API_TOKEN" }
    }
  }
}

Two failure modes worth calling out explicitly for implementers:

1. For API token connections, an invalid or malformed token does not produce a transport-level 401/403. The HTTP call returns 200 OK; the failure surfaces inside the JSON-RPC result as isError: true, e.g. {"content":[{"type":"text","text":"fulcrum request failed: HTTP 401"}],"isError":true}. Check for this; don't assume 200 means success. (A request with no Authorization header at all does get a clean 401.)
2. Immediately after initialize, MCP can return a one-time 400 invalid session ID header. Retrying the same request with the same session ID succeeds. This is a known backend session-affinity issue on the MCP gateway, not a client bug — implement one retry on this specific error rather than surfacing it to the user.

Tools

App MCP tools help with building/managing apps (forms, choice lists, webhooks, extensions, report templates, schema, etc.) and are prefixed with app-mcp_.
Query MCP tools provide read-only data access, and are prefixed with query-mcp_.

To see the current complete list, first connect your MCP-compatible client to Fulcrum, then open that client’s MCP tools/server inspector and view the tools exposed by the connected server. In clients that expose raw MCP protocol methods instead of a tools browser, send the MCP tools/list request over the established client connection and inspect the response there.

AI Toolkit installation

Microsoft 365 quick notes:

1. Download fulcrum-ai-toolkit-m365.zip from the latest release.
2. Upload the complete ZIP without extracting it.
3. Do not use GitHub's Source code (zip)/Source code (tar.gz) archives or a ZIP of the repository.

The Toolkit contains skills covering the build lifecycle: discovery, field/structure selection, safe automation, data-event patterns, safety-field flagging, and querying data. Full skill list and source: github.com/fulcrumapp/fulcrum-ai-toolkit.

Known limitations (Alpha)