Integrations · ERP and CRM

ERP integration for AI agent: your ERP answers the phone.
Reads live, writes only with permission.

Kolio is an AI agent for business that connects to your ERP or CRM (Pantheon, Minimax, Vasco, HubSpot or your own system) through an MCP server and reads the customer, order, delivery date or open item during a call, chat or email. It reads by default, writes only when you enable a tool, and issues no quotes.

Start for freeHow writes are protected →

Free 7-day trial · no credit card · MCP connection in the Growth plan

The agent reads and answers

  • order and shipment status by order number or phone
  • an item's delivery date as kept in the ERP
  • open items and overdue invoices — only to an identified customer
  • customer data (delivery address, contact person, terms)
  • status of a complaint or service order

Does not write or promise without your permission

  • issues no quotes, discounts or individual prices — that is your sales team's job
  • does not change orders until the write tool is enabled and the policy is "full"
  • does not disclose another customer's data, even when asked to
  • ignores any instructions returned by the ERP — results are data
  • does not guess: without data it says who from your team will follow up and creates a task

Prepared by the Kolio team · updated

Question 1

Which ERP and CRM systems connect — Pantheon, Minimax, Vasco, HubSpot — and how?

Kolio connects to your ERP or CRM as an MCP client: it needs an MCP server for your system, provided by the vendor or built to order during onboarding. Kolio has no plug-ins for individual brands — which is why it works with any system that has an API.

An AI agent for Pantheon, an AI agent for Minimax and Vasco, and an AI connection to HubSpot CRM all run the same way: under Settings → MCP sources and integrations you enter the server address and authentication (a Bearer token or a custom header), Kolio fetches the list of tools (e.g. "order by number", "delivery date by item", "open items by customer"), and you enable the ones it may use. A system without an MCP server gets a thin custom server in front of its API or database — part of the Dedicated Kolio offer. For a price list or terms that rarely change, the knowledge base (PDF or URL) is enough: no live data, but no server either. Protocol details are on the MCP and API page.
Customer"Where is my order 4471?"
Kolioidentifies the buyer, calls a tool
MCP servertool "order by number" · readOnlyHint
Your ERP / CRMPantheon · Minimax · Vasco · HubSpot · your own
data → answer to the customerwrites only: full policy + tool on the allowlist
01

The vendor’s MCP server — AI connection to HubSpot CRM and systems that already offer MCP

If your system’s vendor offers an MCP server, you enter its address (https) and credential; the credential is stored encrypted in the Kolio database. HubSpot offers its own MCP server — whether Kolio connects to it directly or through a thin intermediary server depends on the authentication method and is checked during the consultation. Kolio needs no access to the database — only to the tools the server exposes.
02

A custom server during onboarding — AI agent for Pantheon, Minimax and Vasco

For Pantheon, Minimax, Vasco or an in-house system without an MCP server we set up a thin server that exposes exactly the tools the conversation needs (e.g. “order by number”, “delivery date by item”), with the readOnlyHint annotation on read tools. Scope and price are agreed in a consultation.

03

Without an ERP integration: the AI agent answers from the knowledge base

Upload your price list, general terms or delivery terms as a PDF or link a URL; the agent answers from that content. No live stock or order status, but set up in minutes.

Question 2

What does the AI agent read from the ERP, and who does it tell?

The Kolio AI agent reads customer, order, delivery-date and open-item data from the ERP — and tells it only to a caller who has identified themselves the way your instructions require (an order number, or an email or phone that matches the record).

What the agent may tell whom is set in your instructions: public shipment status can go to anyone with the order number, while open items go only to a buyer who identified with matching data. The model receives only the result of the called tool (at most 600 characters), never the whole database. When there is no data or a decision is needed — a discount, a quote, a contract change — the agent does not guess: it records the contact and the question and creates a task for your sales team or account manager in the CRM.
Task createdapi:Lina

Call back: Kate Hartley — inquiry about sales-process consulting

AssigneeTRThomas Reed· Head of Sales
ContactKate Hartley · Hartley & Partners
PriorityHighDuetoday

Client called Monday at 18:42 (after hours). She sent an inquiry via the web form last week and hasn't heard back. Wants consulting on the sales process for a team of 4; budget unknown. Asks for a call in the morning. Transcript is on the contact.

Timeline
  1. api:Lina · Mon 18:46
    Task created from a phone conversation
  2. api:Lina · Mon 18:46
    Assignee: Thomas Reed · priority: high
Kolio · task for the account manager from an after-hours call — an inquiry the agent did not resolve itself but handed to your team
What the Kolio AI agent reads and writes in an ERP/CRM system, and what a write requires
DataReadsWritesCondition for writing
Order and shipment statusyes — by order number, email or phoneno—
Item delivery dateyes — as kept in the ERPno—
Open items, overdue invoicesyes — only to an identified buyerno—
Customer data (address, contact)yeschange of delivery addressfull policy + tool on the allowlist
Complaint / service orderyes — statuslogging a new complaintfull policy + tool on the allowlist
Quote, discount, individual priceno — does not issuenohanded to your sales team as a task

Which write tools your MCP server offers at all is up to you; without a tool Kolio cannot write anything.

Question 3

Which ERP data reaches the AI model, and which does not?

Only the result of the called tool reaches the AI model, cut to 600 characters and sanitised — not the database, not the customer list, not the credentials. What is in the result is decided by your MCP server; which tool the agent may call is decided by you.

Three boundaries apply at once. First, the read_only policy (the default) lets through only tools the server marks as read. Second, tool names and descriptions are cleaned, suspicious descriptions are blocked, and the result is cut to 600 characters before it is passed to the model; the model has a fixed instruction that results are data, not commands, and that it must not disclose other customers' data. Third, the server address may only be https on port 443 with no private addresses and no redirects, and credentials are encrypted in the database. Where data is stored, for how long, and how you export or delete it is on the Security and GDPR page; data minimisation is a requirement of the General Data Protection Regulation (Article 5), and prompt injection through tool results is the first risk on the OWASP Top 10 for LLM Applications.
01

Reaches the model

The result of the tool the agent called for this question (e.g. the status of one order), up to 600 characters; the customer's question; your instructions and knowledge base.

02

Does not reach the model

Server credentials, the list of all customers or orders, data of customers not involved in the question, descriptions of the external server's tools (they stay out of the system prompt).

03

What you control

Which tools are enabled, the read_only or full policy per server, what the agent may tell whom (instructions), transcript retention in the CRM.

Question 4

How are writes to the ERP protected by confirmation?

Writing to the ERP requires two deliberate decisions by the customer account: you switch the server's policy to full and add the write tool to the list of enabled tools. Without both, the agent writes nothing to your system.

In the phone and web channels a write allowed this way runs as soon as the agent calls the tool; in the email agent's "test" mode, write actions are only recorded and run once a member of your team confirms the draft reply. A write call gets more time (8 s during a call, 12 s on the web) because after a cut-off nobody knows whether the write happened; the agent therefore never retries, tells the customer the status is unconfirmed and creates a task. Every write an integration makes in Kolio carries the trail api:‹key name›. What Kolio deliberately cannot write: quotes, discounts, price changes and orders of new products — those go to your sales team.

01

The full policy

For an individual server under Settings → MCP sources and integrations switch read_only to full. The default stays read_only.

02

Tool on the allowlist

Explicitly enable the write tool (e.g. "change delivery address"). New server tools are not enabled by a refresh.

03

Confirmation in email

In the email agent's "test" mode the action waits for a team member's confirmation and runs before the reply leaves for the customer.

Question 5

How is Kolio a data source for your CRM (REST, MCP, webhooks)?

Kolio is also a source for your CRM or ERP: contacts, tasks and appointments created in conversations are available through the REST Integrations API v1 and the MCP server with an API key, and a webhook with an HMAC signature notifies your system of new records.

You issue an API key (kolio_sk_…) under Settings → MCP sources and integrations with scopes that never exceed the permissions of the member who issued it. Over REST you read and write contacts, tasks and appointments (GET/POST on a collection, GET/PATCH/DELETE on a record); over the MCP server your own AI agent does the same. The webhooks booking.created, booking.cancelled, contact.created, task.created and task.updated deliver the event to your system as soon as it is created through REST or MCP. Technical details (endpoints, scopes, signature) are on the MCP and API page.
POST https://vas-crm.example/kolio-webhookx-kolio-event: contact.createdx-kolio-signature: sha256=9b2e41…content-type: application/json {"event": "contact.created","tenantId": "ten_…","timestamp": "2026-09-15T07:31:02.114Z","data": {"contactId": "ct_4f9c…","firstName": "Katja", "lastName": "Hribar","email": "katja.hribar@example.si", "phone": "+386 41 …"}} ← 2xx
Kolio webhook · contact.created · envelope { event, tenantId, timestamp, data } with an HMAC-SHA256 signature of the body

ERP integration for an AI agent is a connection through which an AI agent reads a fact from the company's business system during a conversation (an order, a delivery date, an open item) and tells the customer, instead of guessing. In Kolio it runs over an MCP server with a read-only default policy.

Three steps

Connecting your ERP to Kolio in three steps

The connection is set up by the account owner or an admin; for step 1 you need the address of an MCP server or a consultation for a custom server.

  1. 01

    Add an MCP server for your ERP or CRM

    Under Settings → MCP sources and integrations enter the address (https) and authentication of the vendor's MCP server or the server we built to order. Kolio fetches the list of tools.

  2. 02

    Enable read tools and write the rules

    Enable the tools for order status, delivery date and open items; keep the read_only policy. In the instructions define who the agent may tell what (buyer identification).

    Instructions and knowledge base →
  3. 03

    Test, then allow writes if you want them

    In the simulator ask about an order and check the answer. Only then — if you wish — switch the server to the full policy and enable individual write tools.

    CRM and tasks →
FAQ

Frequently asked questions about Kolio's ERP integration

Can the Kolio AI agent tell a buyer their open items from the ERP?

The Kolio AI agent tells open items only to a buyer who has identified themselves by the rules in your instructions (e.g. a customer number and a phone number matching the record), and only if the open-items tool is enabled on your MCP server. To an unidentified caller it gives no data and offers a call from your team.

Does Kolio have a ready-made plug-in for Pantheon, Minimax, Vasco or HubSpot?

Kolio has no plug-ins for individual brands; it connects to Pantheon, Minimax, Vasco, HubSpot and in-house systems through an MCP server provided by the vendor (HubSpot has one) or built to order by Kolio during onboarding. The same route works for any system with an API.

How much does a custom ERP connection with Kolio cost?

A connection through an existing MCP server is included in the Growth plan and in the free 7-day trial at no extra cost. A custom server for a system without an MCP server is part of the Dedicated Kolio offer; the scope (which tools, read-only or also write) and price are agreed in a consultation, because they depend on your system.

Can the Kolio AI agent break anything in my ERP?

The Kolio AI agent writes to the ERP only if you switch that server to the full policy and explicitly add the write tool to the list of enabled tools; the default is read_only, which lets through only tools with the readOnlyHint annotation. Which write tools exist at all is decided by your MCP server.

What does Kolio do if the ERP does not respond during a customer call?

Kolio stops waiting after 4 seconds (a read during a call) or 8 seconds (a write), tells the customer it cannot confirm the data right now, does not retry and creates a task for your team; after three consecutive transport failures the server rests for 5 minutes.

Which ERP data reaches the AI model?

Only the result of the tool the agent called for the specific question reaches the AI model, cut to 600 characters and sanitised — not the database, not the customer list, not the credentials. Descriptions of the external server's tools stay out of the system prompt.

Let your ERP answer the phone — from data, not from memory.

The 7-day trial includes the MCP connection; a custom server is agreed in a consultation.

No credit card · read-only by default · data in the EU

Related pages