OpenSuiteMCP

Docs/Self-host

Org-hosted architecture

Forwardable overview for architects and security: where the app runs, what leaves your boundary, and how NetSuite + your LLM fit together. Step-by-step install stays in the GitHub README.

Trust boundaries

OpenSuiteMCP is a NetSuite MCP client. In an org deploy, you run the chat UI, auth, and data stores yourself. Tool calls go to NetSuite’s AI Connector; model calls go to the LLM provider you configure (BYOLLM).

Org users talk to OpenSuiteMCP in your VPC. The app talks to your chosen LLM, NetSuite AI Connector, and Postgres/Redis.
Org users
OpenSuiteMCPin your VPC
Org-chosen LLM
NetSuite AI Connector
Postgres · Redis
  • Stays in-org: app process, session/auth config, Postgres (chats, settings), Redis, encrypted LLM API keys, your OAuth client secrets for NetSuite DCR.
  • Goes to NetSuite: OAuth to AI Connector and MCP tool calls (SuiteQL, records, etc.) against accounts you connect — same path Oracle documents for the connector.
  • Goes to your LLM: chat messages, tool results returned into the session, and system/skill context. BYOLLM means your key or private endpoint — not a shared multi-tenant model account inside OpenSuiteMCP. It does not keep ERP data on-device.

Typical deploy shape

Most teams run the source-available app behind their reverse proxy with Docker Compose for Postgres, Redis, and optional SearXNG (web search). Production images follow the same app; hosted opensuitemcp.com is that product plus Google / email auth for evaluation — not a different NetSuite data path.

Clone, pnpm setup:backend, migrate, sync skills, run. Full commands: unstackedapps/opensuitemcp.

Secrets to plan for

  • LLM provider API keys (stored encrypted in your DB)
  • Postgres and Redis credentials
  • Auth secrets (NextAuth / session)
  • NetSuite Integration / DCR client material and redirect URI pointing at your callback URL
  • Optional GITHUB_TOKEN for higher limits when syncing Oracle Agent Skills

Auth

The source-available repo uses email/password (and guest) credentials for sign-in. Hosted OpenSuiteMCP adds Google OAuth for quick trials. Put the app on your corporate IdP / SSO at the reverse-proxy or identity layer if that is your standard — the product itself does not invent a separate enterprise SSO product surface beyond what you deploy.

Hosted vs self-host

  • Hosted — poke at UX, BYOLLM, and NetSuite connect before committing infra. NetSuite still authenticates through AI Connector; we don’t warehouse ERP passwords in a black box.
  • Self-host — when policy, residency, or control requires the app stack (UI, DB, keys, logs) under your org. Prefer this for production NetSuite AI workflows with privacy or compliance review.

Who may run this

  • Free — your organization self-hosts OpenSuiteMCP for its own internal NetSuite AI use (Sustainable Use License).
  • Paid — commercial delivery, paid implementation, or paid ongoing support of this product — only through Unstacked Apps (support@unstackedapps.com).
  • Not allowed — third parties charging to implement, host, white-label, or commercially support this codebase for someone else. See LICENSE.

Next steps