Cereon CRM
An enterprise CRM with an embedded MCP server that does the part most teams skip — correctly.
MCP tools — every one RBAC-gated
permissions across 5 role ranks
of MCP tool calls written to the audit log
GCM field encryption at rest
The problem
Anyone can auto-expose endpoints as an MCP server in an afternoon. Almost nobody ships the layer that makes it safe for a multi-tenant product: role-aware authorization on every tool, an audit trail, scoped credentials, and guards against the MCP-specific attack classes.
A full multi-tenant CRM where every MCP tool is RBAC-gated, every call is written to an audit log, API keys are scoped and kind-restricted, and webhook delivery is SSRF-guarded. It is a working reference implementation of the secure, governed layer that turns a commodity MCP server into one you can put in front of real users — and the build behind the walkthrough above.
What it does
A full CRM, not a demo
Companies, deals, contacts and activities with a working pipeline, custom fields, bulk import and an audit log — a real product you can read end to end.
Unified mailbox & scheduling
IMAP, Gmail and Outlook in one inbox, with booking pages, calendar sync and call transcripts attached to the right records.
An embedded MCP server
Over two hundred tools at /api/mcp, so an agent can drive the CRM the same way a person does — through the very same authorization.
Authorization on every call
requireWorkspaceRole and enforceMutation run before anything changes; five role ranks and forty-plus permissions, enforced identically for the UI and for agents.
Pluggable document storage
S3, Google Drive or OneDrive behind one interface, with per-file access-control lists — no lock-in to a single store.
Hardened by default
SSRF-guarded webhooks that resolve every A/AAAA record and refuse private ranges, plus scoped API keys hashed at rest.
What we built
- Embedded MCP server with per-tool RBAC — the same role hierarchy enforced for the UI is enforced for agents.
- An audit-log row written for every single tool call, with redacted arguments and outcome.
- API keys that are SHA-256 hashed at rest, scoped by kind, and restricted by an explicit method/path allowlist.
- SSRF-guarded webhook delivery that resolves every A/AAAA record and refuses private ranges.
Stack
- Next.js 16
- React 19
- TypeScript
- Prisma / PostgreSQL
- Model Context Protocol
- BullMQ
- Terraform / K8s
How it works
- 01
Authenticate
An agent presents a scoped ts_ workspace API key — never a user session — to /api/mcp.
- 02
Authorize
requireWorkspaceRole checks the caller's rank and enforceMutation checks record ownership before any write.
- 03
Execute & audit
The tool runs against the same models as the UI, and a row is written to the audit log with redacted arguments and the outcome.
- 04
Return safely
Every error passes through classifyError, so responses stay structured and never leak internals.
That we build the secure, multi-tenant MCP layer as a first-class concern — not an afterthought bolted on before launch. Watch it run end to end, then we walk you through the governance layer line by line.