Skip to main content

Connect Nexatron to Claude

Add Nexatron to Claude as a remote MCP connector and ask your governed enterprise data in plain English — directly inside a Claude conversation. There is nothing to install: Claude connects to Nexatron's hosted MCP endpoint over OAuth 2.1, and every request runs inside your tenant with full row-level security and certified-metric enforcement.

This is the recommended path for claude.ai and the Claude desktop and mobile apps. If you instead want a local stdio server for Claude Desktop's config file, see the MCP Integration quickstart.

What you need​

  • A Nexatron account on your organization's tenant (any role; tools inherit your own permissions and data access).
  • A Claude plan that supports custom connectors (Pro, Max, Team, or Enterprise). Team and Enterprise admins can enable the connector once for the whole organization.

Add the connector​

  1. In Claude, open Settings → Connectors (Team/Enterprise admins: Settings → Connectors in the admin console).

  2. Choose Add custom connector.

  3. Set the Remote MCP server URL to:

    https://api.nexatron.io/api/v1/mcp

  4. Select Add / Connect. Claude discovers Nexatron's OAuth configuration automatically and opens a sign-in window.

  5. Sign in with your Nexatron credentials and approve the requested access. Claude exchanges an authorization code for a scoped token using PKCE — your password is never shared with Claude.

  6. The connector shows as Connected. Nexatron's tools are now available in any new chat.

That's it. Start a conversation and ask a question about your data.

Workspace approval (first connect)​

Connecting an MCP client to a workspace is gated by a tenant admin — a security control so no individual user can wire an external client to your tenant's data without oversight.

  • The first tenant admin to connect approves the connector for the whole workspace. When someone with the tenant_admin (or platform_admin) role completes the sign-in above, Nexatron records the approval automatically and every other user in the workspace can then connect with no further prompts.
  • If a non-admin connects first, the attempt is recorded as a pending request and they're asked to have an admin approve it. A tenant admin reviews and approves pending requests in Nexatron under Admin → AI → MCP → Pending approvals (or simply by connecting themselves). After approval, the user reconnects and is in.

What you can do​

Once connected, Claude can call Nexatron's governed tool surface on your behalf. The read tools answer questions and explore your model; the action tools run approved changes and only after an explicit dry run. A few examples:

  • Ask in plain English — "What was net revenue by region last quarter?" Claude routes the question through Nexatron's governed NL-to-SQL pipeline, which enforces row-level security, certified metrics, and the semantic layer before any SQL runs.
  • Query certified metrics — "Show monthly recurring revenue for FY26 by plan." Answers come from the certified metric definition, not an ad-hoc query.
  • Compare across sources — "Compare active customers between Snowflake and the Postgres OLTP." Nexatron federates the result in-memory across connections.
  • Explore the model — list connected sources, list and explain metrics, and inspect how a governed number is defined and proven.

For the full catalog of tools and the governance-contract introspection tools, see the MCP Integration reference.

How it stays secure​

  • OAuth 2.1 with PKCE. Claude never sees your password. Tokens are scoped (for example mcp:read, mcp:query, mcp:metrics:execute) and short-lived, with refresh handled automatically.
  • Tenant isolation. Every tool call resolves your tenant from the token and filters on it; Nexatron enforces four-layer row-level security so a connection's data can never cross tenants.
  • Read vs. action tools. Tools are annotated so Claude can tell read-only introspection from state-changing actions. Action tools are marked destructive and always run a dry run you can review before anything executes.
  • Your warehouse credentials never leave Nexatron. Source credentials are stored AES-256-GCM-encrypted in the connections store and used only inside your tenant — they are never exposed to Claude.

Troubleshooting​

The sign-in window doesn't appear, or shows an error. Make sure pop-ups are allowed for Claude, then remove and re-add the connector. The connector URL must be exactly https://api.nexatron.io/api/v1/mcp.

"Needs a workspace admin to approve this connector." Connecting is gated by a tenant admin (see Workspace approval). Your request is recorded automatically — ask a tenant admin to approve it in Admin → AI → MCP → Pending approvals, then reconnect. A tenant admin who connects is approved automatically.

Tools don't appear in a chat. Confirm the connector shows Connected in Settings, then start a new conversation. On Team/Enterprise plans, verify your admin has enabled the connector for your workspace.

"Unauthorized" after some time. Your session token expired and could not refresh. Open Settings → Connectors, reconnect Nexatron, and sign in again.

Permission or empty results. Tools inherit your Nexatron permissions. If you can't see a connection or metric in Nexatron itself, Claude won't either — ask your workspace admin for access.

Next steps​

Last updated on