Connect Agiloft to ChatGPT: Manage records, files and action buttons

If you need to connect Agiloft to ChatGPT to automate contract lifecycle management, orchestrate custom tables, or execute asynchronous action buttons, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool-calling capabilities and Agiloft's highly configurable REST API. You can either spend weeks building, hosting, and maintaining a custom MCP infrastructure to handle Agiloft's unique Knowledgebase (KB) schemas, or you can use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Agiloft to Claude or explore our broader architectural overview on connecting Agiloft to AI Agents.

Giving a Large Language Model (LLM) read and write access to a highly customizable platform like Agiloft is a massive engineering challenge. You have to handle dynamic table structures, specialized choice-line ID lookups for SQL queries, and strict record-locking requirements. Every time an admin adds a new field or choice list to the Agiloft KB, a hardcoded custom server requires code updates and redeployments.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Agiloft, connect it natively to ChatGPT, and execute complex contract and record workflows using natural language.

The Engineering Reality of the Agiloft API

A custom MCP server is essentially a self-hosted integration middleware layer. While the open MCP standard provides a predictable JSON-RPC 2.0 format for models to discover and execute tools, implementing it against Agiloft's API is exceptionally painful.

If you decide to build a custom MCP server for Agiloft, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with Agiloft:

Choice-Line IDs vs. Labels in SQL Queries

Agiloft relies heavily on a SQL-like querying system for retrieving records (EWSelect). However, when filtering by choice lists (dropdowns), the Agiloft database does not accept the human-readable string label. Instead, it requires the internal integer ID for that specific choice. Because choice-line IDs change when a Knowledgebase is copied or choice lists are recreated, you cannot hardcode them in your integration. Your MCP server must dynamically execute a choice-line lookup (EWGetChoiceLineId) before it can construct a valid where clause for the LLM. If you skip this, the LLM will hallucinate queries that return zero results or throw database syntax errors.

Strict Record Locking Lifecycles

Unlike basic SaaS APIs where you simply send a PATCH request to update a record, enterprise configurations of Agiloft often require strict concurrency control. Before an LLM can safely edit a complex contract record, it must check the lock status, acquire a lock (EWLock PUT) for the connected user, execute the update, and then release the lock. Managing this state machine inside a custom MCP server requires careful orchestration to prevent AI agents from leaving records permanently locked if an update fails midway.

Asynchronous Action Buttons

Agiloft workflows are often driven by Action Buttons configured by the KB admin (EWActionButton). These operations do not return an immediate success or failure response. Instead, they execute asynchronously and return a callback ID. Your MCP server must provide tools that allow the LLM to trigger the action button, receive the callback ID, and then poll a separate lookup endpoint (EWAsyncStatus) until it receives a 200 (completed) or 501 (failed) status code. Translating this asynchronous polling pattern into synchronous tool calls for an LLM is a frequent point of failure for custom integrations.

Dynamically Generating Agiloft MCP Tools

Truto solves these integration hurdles by treating tool generation as a dynamic, documentation-driven process. Rather than forcing you to hand-code tool definitions for every possible Agiloft table, Truto derives them from the integration's resource definitions and schemas.

When you connect an Agiloft instance, Truto generates tools based on the available API methods (like records.list, record_locks.lock, or action_buttons.execute). Truto injects context directly into the tool descriptions - for instance, instructing the LLM to use the choice_lines.lookup_id tool before attempting a search query.

When ChatGPT calls a tool, the arguments arrive as a flat JSON object. Truto's MCP router dynamically splits these arguments into query parameters and request bodies based on the integration's schemas, executing the request against Agiloft's proxy API and returning a formatted JSON-RPC response.

Agiloft to ChatGPT Quickstart Guide

To connect Agiloft to ChatGPT using Truto, you need to authenticate the integrated account, generate the MCP server URL, and register that URL with your ChatGPT client.

Step 1: Create the Agiloft MCP Server

An MCP server in Truto is scoped to a single connected Agiloft Knowledgebase. You can generate this server via the Truto dashboard or programmatically via the API.

Method A: Via the Truto UI

1. Navigate to the Integrated Accounts page in your Truto dashboard and select your connected Agiloft instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (name, allowed methods, allowed tags, and expiration).
5. Copy the generated MCP server URL (it will look like https://api.truto.one/mcp/<token>). Treat this URL as a secure credential.

Method B: Via the API You can generate an MCP server dynamically by making a POST request to the Truto API. This is ideal for provisioning MCP servers on the fly for specific users or automated agent workflows.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ChatGPT Agiloft Server",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["records", "files", "actions"]
    }
  }'

The API validates that the integration has tools available, generates a secure token, and returns a ready-to-use URL in the url field.

Step 2: Connect the MCP Server to ChatGPT

Once you have the URL, you need to register it as a custom connector in ChatGPT. You can do this through the desktop application UI or via a manual configuration file.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings -> Apps -> Advanced settings.
2. Enable Developer mode (MCP support requires this flag to be active).
3. Under MCP servers / Custom connectors, click to add a new server.
4. Enter a descriptive name (e.g., "Agiloft Enterprise Ops").
5. Paste the Truto MCP URL into the Server URL field and save. ChatGPT will automatically run the initialization handshake and discover the Agiloft tools.

Method B: Via Manual Config File If you are managing configurations programmatically or using an MCP inspector, you can add the server using the standard MCP configuration JSON format. Because Truto MCP servers operate over Server-Sent Events (SSE) via HTTPS, you use the standard HTTP transport.

{
  "mcpServers": {
    "agiloft_prod": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/YOUR_SECURE_TOKEN"
      ]
    }
  }
}

Agiloft Hero Tools for ChatGPT

Once connected, Truto exposes Agiloft's capabilities as function-calling tools. Instead of exposing raw EW endpoints, Truto normalizes the operations. Here are the highest-leverage tools available for your AI agents.

agiloft_records_search

Agiloft supports a proprietary natural language processing search API (EWNLPSearch). This tool allows the LLM to pass plain-text search strings directly to Agiloft's search engine, bypassing complex SQL syntax. The tables searched are restricted to those configured for chat search in the Agiloft KB.

"Search Agiloft for all active NDAs submitted last month and summarize their current status."

list_all_agiloft_record_ids

When an LLM needs precise database filtering, this tool executes an EWSelect operation using a SQL where clause. Because it runs at the database level, the LLM must use internal database column names and choice-line IDs. This is the primary tool for fetching large datasets or highly specific cross-table record criteria.

"Find all record IDs in the contract table where the status ID equals 14 and the renewal date is within the next 30 days."

agiloft_choice_lines_lookup_id

Before an LLM can use list_all_agiloft_record_ids, it must know the integer ID for any choice lists (dropdowns). This tool allows the LLM to look up the internal ID of a choice-list value dynamically, preventing query failures caused by hardcoded strings.

"Look up the internal choice line ID for the 'Pending Approval' status so I can use it in my next search query."

create_a_agiloft_record_upsert

This tool executes an EWUpsert operation, which is much safer for AI agents than a blind create or update. The LLM provides a match_query. If no record matches, Agiloft creates a new one. If exactly one matches, it updates that record. If multiple match, it safely fails with a 409 error, preventing the AI from corrupting duplicate records.

"Upsert the vendor record for Acme Corp. If they exist, update their compliance tier to 'Tier 1'. If not, create a new record with these details."

agiloft_action_buttons_execute

Agiloft allows admins to define complex, multi-step workflows triggered by action buttons on a record. This tool allows the LLM to trigger those buttons asynchronously. It returns a callback ID that the LLM must then use with the agiloft_async_operations_lookup tool to poll for completion.

"Execute the 'Initiate Legal Review' action button on contract record 1045 and let me know when the async operation completes."

agiloft_record_locks_lock

Data integrity is critical in enterprise systems. This tool allows the LLM to execute an EWLock PUT request on a record. It locks the record for the connected user so no human agents or other API processes can edit it while the LLM is working on it.

"Acquire a lock on employee record 892. I need to update their compensation details and don't want anyone else editing it concurrently."

To view the complete inventory of Agiloft tools, including attachment management, table metadata lookups, and saved search listing, visit the Agiloft integration page.

Workflows in Action

When you combine these tools, ChatGPT transforms from a simple chatbot into a capable enterprise agent. Here are concrete examples of how an AI agent navigates Agiloft's specific API requirements.

Workflow 1: Safe Contract Review and Lock Acquisition

A legal operations manager wants ChatGPT to find a specific contract, lock it to prevent human interference, update a critical clause, and release the lock.

"Find the active NDA for Acme Corp. Lock the record, update the expiration date to December 31st, and then unlock it."

1. ChatGPT calls agiloft_records_search with the query "active NDA for Acme Corp" to retrieve the exact record ID.
2. ChatGPT calls agiloft_record_locks_lock passing the record ID to secure an exclusive lock on the document.
3. ChatGPT calls update_a_agiloft_record_by_id to modify the expiration date field.
4. ChatGPT calls agiloft_record_locks_unlock to release the record back to the team.

The user receives a confirmation that the exact record was successfully updated without risking a race condition with other system users.

sequenceDiagram
  participant User as User
  participant ChatGPT as ChatGPT
  participant TrutoMCP as Truto MCP
  participant Agiloft as Agiloft API

  User->>ChatGPT: "Find NDA for Acme Corp, lock it, update date, unlock"
  ChatGPT->>TrutoMCP: Call agiloft_records_search
  TrutoMCP->>Agiloft: POST /EWNLPSearch
  Agiloft-->>TrutoMCP: Returns record ID 1045
  TrutoMCP-->>ChatGPT: Record ID 1045
  
  ChatGPT->>TrutoMCP: Call agiloft_record_locks_lock
  TrutoMCP->>Agiloft: PUT /EWLock
  Agiloft-->>TrutoMCP: Lock confirmed
  TrutoMCP-->>ChatGPT: Lock active

  ChatGPT->>TrutoMCP: Call update_a_agiloft_record_by_id
  TrutoMCP->>Agiloft: POST /EWUpdate
  Agiloft-->>TrutoMCP: Update success
  TrutoMCP-->>ChatGPT: Update success

  ChatGPT->>TrutoMCP: Call agiloft_record_locks_unlock
  TrutoMCP->>Agiloft: DELETE /EWLock
  Agiloft-->>TrutoMCP: Lock released
  TrutoMCP-->>ChatGPT: Lock released
  ChatGPT-->>User: "Acme Corp NDA updated and unlocked successfully."

Workflow 2: Asynchronous Workflow Orchestration

An IT administrator wants ChatGPT to resolve a complex support ticket by attaching an analysis log and triggering an internal Agiloft approval workflow.

"Upload this server log file to ticket 5099, then click the 'Request Manager Approval' action button. Wait for the approval request to queue successfully before confirming."

1. ChatGPT calls create_a_agiloft_attachment passing the raw file content and the record ID for ticket 5099.
2. ChatGPT calls agiloft_action_buttons_execute to trigger the 'Request Manager Approval' button on that record. Agiloft returns a callback ID (e.g., cb-8842).
3. ChatGPT calls agiloft_async_operations_lookup passing the callback ID. If it returns a 201 (queued) or 202 (in progress), ChatGPT waits and tries again.
4. Once the lookup returns a 200, ChatGPT confirms the operation.

The user gets absolute certainty that the heavy background process in Agiloft was successfully dispatched, rather than just a "request sent" confirmation.

Security and Access Control

Exposing enterprise Knowledgebase data to an LLM requires strict security boundaries. Truto provides multiple layers of access control built directly into the MCP token architecture.

• Method Filtering: When creating the server via the /mcp endpoint, you can pass config.methods: ["read"] to ensure ChatGPT can only perform get and list operations, preventing the LLM from accidentally mutating records or triggering action buttons.
• Tag Filtering: You can restrict the server to specific domains using config.tags. If an Agiloft admin only wants the LLM to access support resources, passing tags: ["support"] ensures the server simply does not generate tools for human resources or financial tables.
• API Token Authentication: By default, possessing the MCP URL grants access. By setting require_api_token_auth: true, Truto forces the client to pass a valid Truto API token in the Authorization header, adding a strict second factor of authentication.
• Automatic Expiration: You can provision temporary MCP access by setting an expires_at ISO datetime. Cloudflare KV automatically drops the token at expiration, and a Durable Object alarm purges the configuration from the database.

A factual note on rate limits: When dealing with heavy automation, be aware that Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Agiloft API returns an HTTP 429 error, Truto passes that error directly back to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. Your client or agent framework is entirely responsible for implementing its own retry and exponential backoff logic.

Moving Beyond Brittle Integration Code

Connecting ChatGPT to Agiloft shouldn't require your engineering team to parse EWSelect syntax, maintain choice-line ID mappings, or write custom state machines for asynchronous action buttons. By leveraging a dynamic, documentation-driven MCP server, you eliminate the integration maintenance burden entirely.

When a KB admin updates an Agiloft table or adds a new action button, Truto dynamically regenerates the tools on the next tools/list request. ChatGPT immediately understands the new schema, and your team spends zero time updating integration code.