Configure a compatible MCP client

Generic client configuration

MCP client interfaces differ, but the required Lead360 values are consistent: the official MCP URL, HTTP transport, and an Authorization header containing the private integration token. Use the client documentation to determine whether configuration belongs in a settings form, secure JSON file, environment variable, or managed organization policy.

{
  "mcpServers": {
    "lead360": {
      "url": "https://app.lead360.io/mcp/lead360/v2",
      "headers": {
        "Authorization": "Bearer <LEAD360_TOKEN>"
      }
    }
  }
}

Replace the placeholder through the client secret mechanism. Do not commit a real token in a configuration repository, share it in a screenshot, or paste it into an assistant conversation.

Client compatibility requirements

• The client can connect to an HTTPS MCP endpoint and send custom Authorization headers.
• The client supports JSON-RPC 2.0 initialize, notifications/initialized, tools/list, and tools/call.
• The client can negotiate MCP protocol version 2025-03-26.
• The organization can control who sees the credential and who can invoke tools.
• Logs and diagnostic exports redact Authorization headers and returned customer data.
• The client does not transform operation arguments by adding a tenant or arbitrary endpoint.

Verify the connection

1. Create a separate private integration token for the client and destination sub-account.
2. Add the server URL and Bearer header using the client secure configuration flow.
3. Restart or reload the client MCP connections when required by that product.
4. Confirm the Lead360 server initializes as version 2.0.0.
5. List tools and verify search, fetch, search_operations, describe_operation, and execute_operation.
6. Search for a narrow green read operation included in the token scopes.
7. Fetch its contract before a controlled test.
8. Confirm unrelated operation groups and other sub-accounts are not visible.

Operational controls for assistant clients

An assistant can propose tool calls that are irrelevant, incomplete, or based on an incorrect interpretation. Require the user to review the target and purpose, keep scopes narrow, and design the host application to display operation names and arguments before any consequential workflow proceeds.

Lead360 blocks direct mutations at the public gateway, but the client still needs responsible handling for returned personal data. Limit conversation retention, disable unnecessary training or sharing settings, restrict exports, and use an approved enterprise configuration when customer records are involved.

Assign a connection owner

Record who owns the MCP client configuration, token, destination sub-account, approved scopes, data use, and incident response. The owner should review client updates because an update can change logging, tool presentation, secret storage, or user approval behavior even when the Lead360 endpoint is unchanged.

Use client-level policies to prevent unapproved users from adding servers, exporting conversations, or viewing connection secrets. When a device is lost or an employee leaves, revoke the dedicated token and review recent use rather than relying only on removal from the local client.