Skip to main content
ApexGenius MCP gives a supported AI client an authorized route to a selected app connection. This page explains what happens on a request, what defines the account boundary, and which operational records the gateway keeps. Salesforce examples are used where its deeper record, schema, metadata, staging, and deployment path matters.

​
The request path

  1. You ask something in your AI client (for example, “show me stuck opportunities above the amount I specify”).
  2. The client calls an ApexGenius MCP tool over an authenticated connection.
  3. ApexGenius checks the signed-in identity, account and project context, provider readiness, selected resources, and effective operation catalog.
  4. ApexGenius calls the selected provider using the credential and connection context authorized for that route.
  5. The result passes back through to your AI client, which writes the answer.
Two properties of that path matter more than anything else:

​
What your agent can access

Every newly authorized AI agent has its own scope: Full access, Read only, or Custom. You can also turn individual app connections off for that agent. Existing connection permissions and connection-level tool settings remain the ceiling. The effective catalog is the intersection of the signed-in account, current project and connection access, connection-level tool settings, and the agent’s scope. A broader agent scope cannot restore a connection or tool that is unavailable or switched off elsewhere. Hidden operations are removed from discovery and rejected if an agent tries an older cached name. Existing credentials created before scoped client access have no stored scope and retain their legacy Full access behavior until you replace or revoke them. Activity keeps the configured agent identity separate from best-effort client software metadata.

​
Provider permissions are the ceiling

The connected provider decides what its credential can reach. ApexGenius does not bypass the provider’s permissions, account scopes, selected resources, or plan limits. For Salesforce, profiles, permission sets, object permissions, and field-level security apply to the credential used for the request. Current projects can use per-user Salesforce authorization where it is enabled. Some legacy projects can still use a shared project-level connection. Check the connection mode in the selected Salesforce project before assuming the request uses your personal Salesforce token.

​
What the gateway processes and stores

ApexGenius processes the request and tool result needed to complete each call. It also stores operational application data needed to provide and secure the route, including encrypted authorization references, project configuration, metadata staging you create, usage events, and content-minimized audit entries.
  • Usage events: may include the tool name, duration, and outcome.
  • Write audit log: supported record changes and deploys record who initiated the operation, the affected system and action, and the outcome. The gateway Activity view does not render raw query text, field values, or record IDs.
Your AI vendor processes the conversation under your agreement with that provider. The MCP route returns tool results to the AI client you authorized. The authenticated ApexGenius web app manages accounts, projects, connections, staged metadata, activity, billing, and settings. Public and legacy web Chat are retired. Authenticated Salesforce LWC Chat remains a separate Salesforce project path with the data handling described in the Privacy Policy. Do not use ApexGenius for PHI or another regulated-data workflow unless the required agreements and controls are confirmed in writing.
Write confirmation depends on the client.Write tools are labeled so compatible AI clients can apply their confirmation controls. ApexGenius records supported provider writes, but it does not yet enforce a universal Auto, Ask, or Off approval mode at the gateway.

​
Authentication

The hosted gateway accepts OAuth authorization-code access tokens with PKCE S256 and scoped API keys, both tied to your ApexGenius account. API keys are displayed once at creation and can authenticate subsequent requests until revoked or expired.
  • Claude and ChatGPT: add the hosted connector or app, sign in to ApexGenius, and approve.
  • Codex: start in Plugins in the ChatGPT desktop app with an available personal or shared ApexGenius plugin. The Codex guide also covers desktop MCP settings and optional CLI setup.
  • Cursor, VS Code, and compatible clients: add the streamable HTTP server URL and complete the same browser sign-in.
  • Manual API-key clients: open Connected AI → Add an agent → Another AI agent, choose the intended connections and tools, then create a dedicated key for the client’s secure Bearer authentication field.
The setup guide covers both methods, OAuth discovery and PKCE, key handling, access changes, and a first verified read. Each compatible agent needs its own setup; the same ApexGenius account keeps your app connections and reusable skills available within that agent’s access. Skills load when read and cannot expand permissions. Account access is gated. Sign in to the ApexGenius workspace and open Settings → Billing to confirm the current state and any account-specific terms. When an account is not entitled to an operation, the tool returns an access response instead of performing the request.

Set up the connection

Connect Claude, ChatGPT, Codex, VS Code, Cursor, or another compatible client.

Every MCP tool

The full reference: queries, records, metadata, staged files, and deployments.
Last modified on September 26, 2026