Documented clients
Zoho documents the connection for Claude, ChatGPT, Cursor, Windsurf and VS Code with GitHub Copilot in agent mode, among others.
Zoho MCP: making your business data available to AI, without losing control
What is Zoho MCP and how do you set it up? A look at the connection with Claude, ChatGPT and other clients, how it differs from Zia Agents inside Zoho, and what you need to arrange under the GDPR.
Why this matters now
Your employees already use AI. Not because you decided they should, but because it works. And in practice they do it by pasting business information into a chat window: a customer list for an analysis, a quote to be rewritten, a ticket history to be summarised.
That is the problem MCP offers a solution for. Not by banning it, but by replacing it with something you can set up, limit and log.
The Model Context Protocol is an open standard that defines how AI models talk to external systems in a uniform way. Zoho MCP is Zoho's implementation of it: you make a defined set of functions in your Zoho environment available, and an AI client can use them. No more copying and pasting, but a controlled connection.
What Zoho MCP actually does
In the Zoho MCP console you create an MCP server, choose which tools to make available on it, authorise the connection and copy the server URL. You add that URL to your AI client, and from then on that model can work with the functions you have released.
Depending on what you add, the AI client can for example search and update records, send emails, look up tickets, consult invoices or carry out actions, across several Zoho products at once from the same conversation. That is because you can put tools from different Zoho services on one server.
Also compatible
The server is also compatible with clients such as Zed, Continue, Cline and n8n.
Connecting ChatGPT and Claude
For ChatGPT you need a paid plan and you add the connection as a custom app; for Claude you connect the server as a connector.
What it delivers per application
The two directions, and why that distinction decides everything
This is the part organisations skip most often, and it is where the GDPR questions lie.
-
Inbound
An external AI client (Claude, ChatGPT, Cursor) connects to your Zoho MCP server and works with your data. The content is processed by that AI provider.
-
Outbound
A Zia Agent inside your Zoho environment calls an external MCP server or an external model. Here too data leaves your environment, but the initiative lies with a process you have set up.
Inside Zoho versus outside Zoho: what it means for the GDPR
Both are legitimate. But both are different from what happens when a Zia Agent runs entirely inside Zoho, and you need to be able to explain that difference.
What happens when everything stays inside Zoho. By default, Zia Agents run on Zoho-hosted language models, within Zoho's own infrastructure and the data centre region you have chosen. In practice that means:
- No new processor is added. Zoho already is one, and your existing data processing agreement covers it.
- The agent inherits the role and permission model you have already set up. It sees no more than the user on whose behalf it works.
- Every action ends up in the same log as the rest of your Zoho environment, at record level.
- Your data centre region determines where processing takes place; with an EU region it stays within the EU.
That is a relatively simple story to tell your data protection officer.
What changes once you go outside
As soon as you connect an external AI client to your MCP server, something fundamental changes: a third party becomes a processor of your personal data. That is no objection, but it is something you need to arrange explicitly.
| Inside Zoho (Zia Agents) | Outside Zoho (via MCP) | |
|---|---|---|
| Processor | Zoho, already under contract | Additional party, own agreements needed |
| Record of processing | Existing entry is usually enough | Add a new processing activity |
| Data processing agreement | Already in place | Sign one with the AI provider |
| Data storage | Your Zoho data centre region | The AI provider's region; check for EU or a transfer mechanism |
| Model training | Zoho models, business use | Depends on the plan; business tiers generally do not train, consumer accounts may |
| Permission model | Inherits your Zoho roles | Determined by the tools you release, plus the client's user management |
| Logging | Fully in Zoho | API actions in Zoho; the conversation itself sits with the AI provider |
| Access control | Through Zoho users | Through the MCP server URL and its authorisation |
What you need to arrange before you go outside
This is not legal advice; agree the setup with your data protection officer or privacy lawyer. It is, however, exactly the list that usually lets you wrap up that conversation within an hour.
-
Sign a data processing agreement with the AI provider
Add the processing to your record as well. A business or enterprise account is not a formality here but the basis: consumer accounts have different terms and may use input to improve their models.
-
Check where processing takes place
Does the model run in the EU, or is there a valid transfer mechanism? In healthcare, government, education and financial services this is often the question that decides whether the project goes ahead.
-
Limit what you release
This is the most powerful tool you have and the least used. The tools you put on the MCP server define the entire set of data the AI can reach. Give access to the whole contacts module and you have granted access to all the personal data in it. Start with the minimum, preferably read-only.
-
Agree what it may be used for
Purpose limitation is not a theoretical requirement. An employee who runs customer data through an AI for an analysis nobody asked for is processing personal data for a new purpose.
-
Define who has access
That applies to the AI client connected to your server. The chain is only as strong as the user management on that side.
-
Document the whole setup
So you can explain it. Not because you have to, but because after an incident or during an audit you need to be able to reconstruct it within a day.
The server URL is a key, not a link
One practical security point you should not underestimate: anyone who has your MCP server URL can connect an AI client to it. Treat that URL as a login credential. Do not share it in a group chat, do not put it in widely shared documentation, and create separate servers for separate purposes instead of one server with everything on it.
The sensible order is: start with read-only tools, watch for a few weeks what actually happens, and only add write permissions once it is clear who is using it and for what. An AI that accidentally updates two hundred records is a nastier problem than an AI that read something wrong.
An analysis that used to take an afternoon in Excel, we now ask our AI assistant for in plain language. The answer comes straight from our own Zoho data.
When to choose which
How to set this up in practice
-
Define the use case first
"We want to do something with MCP" leads to a server nobody uses. Start with a concrete question that currently takes a lot of time.
-
Create one server per purpose
Not one server with every tool on it.
-
Start read-only
And with a limited set of modules.
-
Sort out the GDPR side
Before you roll out, not afterwards.
-
Appoint an owner
Someone who knows which servers exist, who has access to them and when access is revoked.
-
Evaluate after a month
Look at what is actually being used, then expand or clean up.
-
Move it to a Zia Agent
As soon as a use case becomes a fixed process. You explore outside, you run inside.
Explore outside, run inside
That is the whole trade-off in one sentence. Zoho MCP is excellent for making your business data accessible to the AI tools your people already use, and it stops them doing so in the worst possible way: by copying and pasting. But for processes that run structurally and touch personal data, a Zia Agent inside Zoho CRM or Zoho Desk is the wiser answer: the same permissions, the same logging, no extra processor.
The skill is not in choosing between the two, but in knowing when to use which.
Frequently asked questions about Zoho MCP
-
The Model Context Protocol is an open standard that defines how AI models talk to external systems. Instead of building a separate connection for every combination of AI tool and application, a system makes its functions available once through an MCP server, after which any MCP-compatible client can work with it. Zoho MCP is Zoho's implementation of it for its own applications.
-
Zoho documents the setup for Claude, ChatGPT, Cursor, Windsurf and VS Code with GitHub Copilot in agent mode, among others. The server is also compatible with clients such as Zed, Continue, Cline and n8n. ChatGPT requires a paid plan and you add the connection as a custom app; with Claude you connect the MCP server as a connector.
-
Zia Agents run inside Zoho, on Zoho-hosted models, with the permissions and logging of your own environment. Zoho MCP opens up your Zoho data to AI clients outside Zoho. Rule of thumb: a process that runs structurally and touches personal data is something you build as a Zia Agent; exploratory and analytical work by specialists can be done perfectly well via MCP. Agents can also call external MCP servers themselves, by the way, so traffic goes both ways.
-
As soon as data leaves your Zoho environment, the AI provider becomes a processor of your personal data. You then sign a data processing agreement, add the processing to your record, check where the model runs and whether there is a valid transfer mechanism, and use a business account where input is not used for model training. On top of that you limit the tools you release to what is strictly necessary and define what the connection may be used for. Agree the final setup with your data protection officer.
-
Security comes down to two things: what you release and who has the server URL. Anyone with that URL can connect a client to it, so treat it as a login credential. Work with separate servers per purpose instead of one server with everything on it, start with read-only tools, and only extend to write permissions once it is clear who is using it. Actions carried out through the server can be traced in your Zoho log.
-
Yes, and that is the most important argument. Your processes and your data stay in Zoho, while the question of which model works on top remains a choice you can revisit. That considerably reduces your dependence on a single AI provider: something that, given the current pace of development, is worth more than it seems at first sight.
-
Not for a standard server: you create it in the Zoho MCP console, select tools, authorise it and copy the URL. If you want to make your own functions available or build a custom server, some development work is involved. Most of the time, however, goes not into the technology but into the questions around it: which tools you release, for whom, and what has been arranged legally.
-
With one concrete question that currently takes a lot of time and does not require sensitive personal data, for example an analysis of aggregated sales or ticket data. Set up a read-only server for it, let one or two people work with it, and evaluate after a month. If it becomes a recurring process, you move it to a Zia Agent inside Zoho.
Want to set this up securely?
Mobile XL is a Zoho partner and helps with setting up MCP servers, scoping tools and permissions, and connecting them to your AI environment.