> For the complete documentation index, see [llms.txt](https://docs.buzzy.buzz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buzzy.buzz/the-building-blocks/mcp/buzzy-custom-mcp.md).

# Buzzy Custom MCP

Buzzy Custom MCP is the workflow for enabling MCP on an app you built with Buzzy. Once enabled, MCP-aware AI assistants can interact with that app's data and actions through Buzzy-generated tools.

Use this section when you want an app to be available to ChatGPT, Claude, or another MCP-compatible client. If you want an AI agent to build or edit the app itself, use [Buzzy Builder MCP](/the-building-blocks/mcp/buzzy-builder-mcp.md) instead.

Custom MCP is not a starting point for creating a new app. Enable it after the app exists, the datamodel is clear, and permissions have been reviewed.

For a side-by-side comparison of Custom MCP, REST API, Async API, Node.js client, Buzzy Functions, and code widgets, see [API and Extension Surfaces](/developing-and-extending-buzzy/api-and-extension-surfaces.md).

## Video Overview

{% embed url="<https://youtu.be/znC1TCOk5P8>" %}

## What Buzzy Exposes

Buzzy generates MCP capabilities from the app you have already built:

* datatable list, get, create, update, and delete tools
* Buzzy Functions that are available as tools
* widgets that can display app data inside an AI assistant experience
* OAuth-based user authentication
* the same server-side data access rules used by runtime and REST API calls

## Example App-Specific Tools

Custom MCP tools are generated from a specific Buzzy app, so the useful tool names and data shapes depend on that app's datamodel. An assistant does not need generic database access; it can use governed tools that match the business objects in the app.

| App                      | Example assistant request                                                                                | What the MCP client can do through Buzzy Custom MCP                                                                  |
| ------------------------ | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| Short Stays property app | "Find available stays in Byron Bay for next weekend and shortlist the three best options for a family."  | List and filter property, availability, pricing, and booking-related rows the user can access.                       |
| Short Stays property app | "Create a draft booking enquiry for this guest and attach these preferences."                            | Create a booking enquiry row and update linked guest preference fields, subject to app permissions.                  |
| Care coordination app    | "Show me clients with overdue care plan reviews and create follow-up tasks for their coordinators."      | Read client and care plan rows, then create task rows assigned to the right team members.                            |
| Compliance workflow app  | "Summarize open high-risk findings and mark the reviewed ones as ready for manager approval."            | List findings, update review status fields, and call an exposed Buzzy Function for summary generation if configured. |
| Support ticket app       | "Update the priority for tickets from Acme Corp and draft a response for each unresolved billing issue." | Search ticket rows, update priority/status fields, and optionally call a response-drafting Buzzy Function.           |
| Field service app        | "Reschedule tomorrow's maintenance jobs for technicians affected by the outage."                         | Read jobs, technicians, and schedule rows, then update appointment records within the user's access rules.           |

These examples are intentionally app-specific. A different Buzzy app exposes a different set of CRUD tools, function tools, and allowed fields because the MCP surface follows that app's datamodel and permissions.

## Security Model

MCP tools follow the same server-side access and [Private Data](/the-building-blocks/datatables-fields-and-data/private-data.md) rules as the Buzzy runtime and REST API.

* MCP calls authenticate as a Buzzy user.
* Row access, Field view, and Field edit rules still apply.
* Basic Private Data is masked or redacted when the caller should not receive the raw value.
* Sensitive Private Data is hidden by default unless the caller has permission to access it through the relevant tool path.
* Private Data image and file fields do not expose denied attachment metadata or signed URLs.

When enabling MCP for a compliance-oriented app, test with both allowed and denied users. Do not assume an AI assistant should receive more data than the same user would see in the Buzzy app.

## Learn More

{% content-ref url="/pages/pLhiHZxENmWpzeMKMOkj" %}
[Implementation](/the-building-blocks/mcp/buzzy-custom-mcp/implementation.md)
{% endcontent-ref %}