Setting up the 3CX MCP server: What AI can do in Update 10

The short answer

• The MCP server ships with 3CX V20 Update 10. Its second release candidate came out on October 29, 2026, and the final release is still pending. Until then, 3CX recommends trying Update 10 only on a test system. 3CX hasn’t decided yet which editions will include the server.
• Setup itself is quick: copy the address under Admin › Integrations › MCP Clients in the 3CX admin console, add it as a custom connection in the AI tool, and sign in with a 3CX account.
• The AI can do exactly what that account can do. Signed in as the System Owner, it also reads recordings, transcripts, and chats. I’d use the account with the smallest role that still covers the task.
• Tools that only read can run without asking, except for recordings. Anything that changes something should require approval in the AI tool, and blocklists and call flow scripts should be set to “Deny.”

What the MCP server does: lots of reading, little changing

When someone asks in a chat, “How many extensions does our phone system have?”, the AI uses the MCP server to pull the user list, for example, and counts. MCP, the Model Context Protocol, is an open standard that lets AI tools query other software this way. The 3CX server provides about 40 tools for it, such as “List queues,” “List recordings,” or “Set queue agent status.” The AI picks the ones it needs for each question.

Most tools only read. They show users, extensions, contacts from the phonebook and the connected CRM, active calls, recordings, voicemails, queues and their agents, departments, phone numbers (DIDs), SIP trunks, the event log, and services. A tool called “Query” queries the system’s database directly, and 3CX only allows read-only SELECT queries.

A smaller set changes things: ending an active call, logging agents in or out of queues, switching a profile (to “Away,” for example), assigning a number, adding IP addresses and phone numbers to the blocklists or removing them, and changing the script of a call flow app.

The AI can’t create users, queues, or groups through the server yet. A partner wrote in the 3CX forum that these are exactly the biggest tasks in selling and maintaining 3CX systems, and 3CX replied that MCP will be developed further. So the server doesn’t replace the admin console, and 3CX itself calls it a companion tool for it.

If the AI needs to do more than 3CX provides, such as linking calls to orders in an inventory system, that takes a custom MCP server that queries both. The Connecting software page shows how Katio Tech builds and runs such servers.

In daily use, it helps with questions more than with actions

Reports are the obvious place to start. 3CX gives weekly summaries for management and queue and agent reports as examples. The AI pulls the data the account is allowed to see and writes the summary someone would otherwise put together by hand.

Next comes finding things. “Was there a voicemail from this number yesterday?” is faster to ask than to look up, as long as the account can see voicemails and recordings.

Where calls are transcribed, the AI can pull the questions customers keep asking out of the transcripts and turn them into a document. Once a person has reviewed it, it becomes a knowledge source for a 3CX AI agent. That’s how 3CX itself describes the workflow, with the review as a fixed step.

For IT, the chat replaces the first look in the admin console: which SIP trunks are set up, which services are running, what the event log says.

The chat can also change a few things, like logging agents out or ending calls. That’s usually just as quick in the admin console or the app. Here I see less benefit and more risk.

The key decision: which account the AI works with

The server checks every request against the permissions of the 3CX account used to sign in the connection. Whatever that account can’t do in 3CX, the AI can’t do either, no matter how it asks. The role in 3CX is the limit that holds.

3CX has roles for the whole system and roles per department. For the AI, what matters most is who can see recordings and reports:

I wouldn’t connect the AI as the System Owner. According to 3CX, it’s the only system-wide role that also sees recordings, transcripts, chats, and call logs.

Update 10 also separates the permissions for reports and recordings, which makes this split easier. 3CX SMB deployments and tenants on a multi-tenant system don’t have the two system-wide roles, though, which leaves only the department roles. 3CX hasn’t said yet whether the MCP server is available there at all.

Which account fits a specific case, step by step:

It stays clearest when everyone connects with their own account instead of a shared admin login. The AI then never sees more than the person does.

For the same reason, I’d start with the 3CX server rather than one of the unofficial community servers. Those work with admin credentials through the Configuration API and can sometimes do more, such as creating users, but they see everything the admin sees, no matter who asks.

Setting up the MCP server in four steps

1. Copy the address in 3CX

   In the admin console, go to Admin › Integrations › MCP Clients, select “Add MCP Client,” and copy the MCP server address exactly as 3CX shows it.

2. Add the connection in the AI tool

   In Claude, go to Customize › Connectors, select “+ Add” › “Add custom connector,” and enter a name and the address. On Team and Enterprise plans, an Owner adds it under Organization settings › Connectors, and then everyone connects on their own. In ChatGPT, workspace admins or owners add it under Plugins with the plus button and “Add custom MCP server,” choose OAuth for sign-in, and then publish it for the workspace. According to OpenAI, the developer mode that the 3CX guide still mentions is no longer needed for this.

3. Sign in with a 3CX account

   The AI tool opens the 3CX sign-in page. Sign in with the account whose permissions the AI should get, review the requested access, and allow it. According to 3CX, the connection then shows up in the admin console under MCP Clients.

4. Set approvals and test

   In the AI tool, decide for each tool whether it can run without asking (see the section below). Then ask in a new chat: “How many extensions does our phone system have?”

For Claude Code in the terminal, 3CX documents a separate route. Add the connection in the project folder, using the copied address instead of the example:

claude mcp add --scope project --transport http 3CX "https://yourpbx.3cx.eu/mcp"

Then start claude, open the server list with /mcp, select the 3CX entry, and choose “Authenticate.” Sign-in then works in the browser as above. If the browser doesn’t open on its own, copy the address from the terminal.

3CX also lists Gemini and GitHub Copilot as compatible, without instructions. Microsoft 365 Copilot isn’t mentioned at all. It can connect custom MCP servers since October 27 (Connecting business software to Copilot), but neither 3CX nor Microsoft has said whether the 3CX sign-in works with it.

When the connection doesn’t work

• Claude always connects from Anthropic’s cloud, even from the desktop app. If the phone system is only reachable inside the company network or over a VPN, or if the firewall only lets certain addresses through, Claude can’t reach it until Anthropic’s IP ranges are allowed.
• If the AI asks for something the account isn’t allowed to do, the server returns an error. 3CX says that’s intended, so check the role, not the connection.
• ChatGPT keeps a snapshot of a server’s tools when the connection is published. If 3CX changes them in an update, for instance with the final release of Update 10, calls can fail until an admin refreshes the tool list in the workspace settings. According to OpenAI, ChatGPT gives no notice when that happens.

Approving tools: reading yes, changes only after asking

The role decides what the AI can do in 3CX. Whether it does so without consent is a second safeguard in the AI tool: for each tool, it can be set to run without asking, only after approval, or not at all. 3CX calls these three levels “Always allow,” “Needs approval,” and “Deny.” This setting grants no extra rights in 3CX. 3CX explicitly recommends setting tools that change something to require approval or blocking them entirely. In ChatGPT Enterprise and Edu, admins can also turn off individual tools for the whole workspace, and new tools from a server start out disabled there.

This is how I’d set it up:

After a few weeks, once it’s clear which queries run every day, some of them can move to “without asking.”

Data protection: what the AI reads goes to its vendor

Whatever the AI pulls through the MCP server ends up with the vendor of the AI tool: callers’ names and numbers, voicemail content, and transcripts. For queues and system data, that’s little personal data; for recordings, it’s entire conversations. Before an account with access to recordings gets connected, there needs to be a data processing agreement (DPA) with the AI vendor. OpenAI offers one for ChatGPT Business, Enterprise, and Edu, and Anthropic includes one in its commercial terms for Claude Team and Enterprise. Individual plans like Plus, Pro, or Max aren’t covered by either.

Reports on individual agents are reports on employees. In Germany, a works council has a say in technical systems meant to monitor employees’ behavior or performance (Section 87(1) no. 6 of the Works Constitution Act, BetrVG). Where one exists, I’d involve it before the AI writes reports on individual people. Elsewhere, it’s worth checking local employment rules first.

Test Update 10 first, and check the edition before buying

3CX introduced the MCP server on July 30, 2026, with the first alpha of Update 10. A second alpha followed, then the beta on September 29, the release candidate on October 13, and the second one on October 29. For the alpha and beta, 3CX said explicitly that they don’t belong on production systems, and for both release candidates it recommends testing on a separate system ahead of the final release. 3CX hasn’t given a date for that, only that Update 10 is in its final stages.

Which editions get the server is also open. In early September, 3CX wrote in its forum that this was still under discussion. In mid-October, a 3CX staff member wrote that the beta also makes the server available with a PRO license. Whether that holds for the final release went unanswered. Anyone renewing or buying a license right now should ask their reseller.

It’s still worth trying now, on a second system: by the final release, it’s settled which roles the AI works with and which questions are useful.

What to do now

• Bring a test system up to Update 10 and connect the MCP server there.
• For each task, pick an account with the smallest role that covers it, never the System Owner.
• Set tools that change something to require approval, and block the blocklist and call flow script tools.
• Before connecting the first account with access to recordings, choose a business plan with a data processing agreement. Before reports on individual people, involve the works council, if there is one.
• Before buying a license, check which edition includes the server in the final release.

Monday morning’s question then goes to a chat signed in with the support lead’s account, so it only sees that team’s queue.