Celigo Platform MCP and Celigo CLI: What They Do and How to Set Them Up Safely

Celigo Platform MCP is a hosted MCP server, run by Celigo, that lets an AI agent such as Claude, ChatGPT, Cursor or VS Code read, build, run and troubleshoot your integrator.io account in plain language. The Celigo CLI (@celigo/celigo-cli) is the command-line tool for the same account: scripts, CI pipelines, and a pull/push workflow that puts your flows in git. Both call the same REST API with the same permissions. Use Platform MCP to explore and fix things in a chat, and the CLI for repeatable, reviewed changes. Before either touches production, bind the session to a sandbox environment and give it a token scoped to what it should change, because writes act on the live account and a delete through Platform MCP is never blocked.

What Celigo Platform MCP and the Celigo CLI are

Both tools came out of Celigo's developer platform at developer.celigo.com, which groups three ways to work with integrator.io from code: the REST API, the CLI and Platform MCP. They operate on the same resources (integrations, flows, connections, exports, imports, scripts, AI agents and more), and one API token works with all three.

Platform MCP is a remote server that speaks the Model Context Protocol over Streamable HTTP. Your AI client connects to it, discovers the tools at runtime and calls them on your behalf. Celigo describes it as a wrapper around the REST API with tool descriptions written for AI agents. It also serves Celigo's skills (30 of them as of the October 28 update): step-by-step guides such as building-flows and troubleshooting-flows that the agent reads before it builds or fixes something.

The Celigo CLI maps every REST resource to a celigo <resource> <verb> command, with account profiles, JSON/YAML/table/CSV output and --jq filtering. Since release 2026.9.1 it can also download an account or one integration as a folder of JSON files, so changes go through git and code review. Installing it also installs the same Celigo skills for Claude Code, Cursor and Windsurf.

Platform MCP vs Celigo CLI vs REST API: which to use

Celigo's own guidance is to pick by how you work, and to combine them. This is the short version of its "which tool to use" table, with what it means in practice:

Because the CLI and Platform MCP call the same API, a common pattern is to explore and diagnose in a chat client, then turn the fix into a reviewed CLI change.

Not the same as Celigo's MCP Server or MCP Management

Celigo now has three things with "MCP" in the name, and they solve different problems:

• Platform MCP (this article): Celigo's own hosted server that lets an agent operate your integrator.io account.
• The Celigo MCP Server (the mcpServers resource): something you build in Celigo to expose your own tools, such as "order status by order number", to AI clients. Celigo's docs call it "a builder-side primitive" and say the two "are separate things". We cover it in Celigo MCP Server: Governed AI Access to NetSuite and its security model in Celigo MCP Server Security.
• MCP Management: announced generally available on October 20, a gateway for running Celigo and third-party MCP servers behind one URL with approvals and logs. See the update note in our MCP security article.

The difference matters for risk. A Celigo MCP Server tool you defined can only do what you built it to do. Platform MCP can do anything your user or token can do in integrator.io, including changing and deleting integrations.

What an agent can change through Celigo Platform MCP

The toolset follows three patterns: list_* tools read, upsert_* tools create or update, and one delete_resource tool deletes. Beyond those, tools such as run_flow, triage_flow_errors, install_template and manage_user also change live data. Four details from Celigo's tool reference are worth knowing before you hand an agent write access:

• Delete never blocks. delete_resource runs a dependency check and returns dependents as warnings, "but the delete always proceeds". Removing a connection that five flows use is one call.
• An update is a full replace. upsert_* with an _id is a PUT of the whole document, so the agent must read the resource first and send it all back. patch_flow exists for single-field flow edits.
• Stored secrets are guarded. The API masks credentials as ******, and since the October 28 update upsert_connection keeps a stored secret when the mask is sent back and refuses a body that would drop a whole block of secrets.
• Failed writes are not retried. Also since October 28, a write that fails with a 5xx or network error is no longer retried by the server, because it may have run. Ask the agent to check whether a write landed before it tries again.

Every tool carries the standard MCP annotations (read-only, destructive, idempotent), so clients that support them can mark writes and ask before destructive calls. That confirmation lives in your AI client, not on Celigo's side, so check how your client handles it.

Guardrails before you connect an agent to production

None of this needs anything outside Celigo's documented settings. These are the five we set up first:

1. Bind the session to a sandbox environment first. With OAuth sign-in you pick one account and one environment, and the session stays there; switching means disconnecting and signing in again. A bearer token is already bound to its account and environment. Confirm which one the agent is in before you ask for changes.
2. Use a scoped token, not a full-access one. Celigo's docs warn that a full-access token "can read, change, and delete everything in your account". Personal access tokens act as the user who created them, and custom-scoped tokens are limited to the resources you select. For an agent, a dedicated token scoped to the integrations it should touch is the real boundary.
3. Use the CLI's permission modes, and know their limit. Every CLI profile runs in read, operate (runs, retries, error handling, no structural changes) or full; the default is full. Read mode refuses every write before the request is sent, and the refusal tells an agent it "must not raise it" to get past it. But a mode "never adds to what the credential itself may do": it only limits what the CLI sends. It is a seatbelt on that machine, and the token scope is the lock. Platform MCP's docs describe no equivalent modes, so there the user or token permissions are the whole boundary.
4. Ask for the plan before every write. This is Celigo's own advice for retries, deletes and updates. In the CLI it is built in: celigo push --dry-run prints the plan, and --prune deletes ask for confirmation.
5. Read the audit log by source. Platform MCP's list_audit_log_entries tool returns field-level changes and filters by source, including mcp and cli. A weekly look at what agents changed is the cheapest control you have. A separate token per agent or pipeline makes each change attributable.

For the governance side of this (who owns each agent and what it is allowed to touch), see our AI agent governance article.

The Celigo CLI in git and CI: pull, review, push

The CLI's local tree is the part most teams have been missing in Celigo: a way to review integration changes like code. celigo pull downloads an account or one integration as a folder of JSON documents (one folder per resource, with a script's source saved as script.js beside it). You edit, commit and open a pull request, and CI checks the plan before anything is written back.

# Install and sign in (or set CELIGO_API_TOKEN)
npm install -g @celigo/celigo-cli
celigo login

# Pull one integration into a folder and put it in git
# (--no-symlinks writes pointer files, which Celigo recommends for git)
celigo pull --integration <integration-id> --dir ./acme --no-symlinks
cd acme
git init && git add . && git commit -m "baseline"

# After editing: check, plan, then write back
celigo status
celigo diff
celigo lint
celigo push --dry-run
celigo push

# Write the same tree into another environment
celigo promote --to sandbox

Several safety rules in the docs are worth knowing:

• Lint runs offline against Celigo's published API schemas and six logic rules.
• Push won't overwrite someone else's change. It refuses any resource someone has changed since your pull.
• Credentials never travel. Push refuses any connection document that still holds the ****** mask, so secrets are not written from files.
• A tree is bound to where it came from. It is tied to the API host and token owner it was pulled with, and push refuses a profile that points anywhere else.
• Promote is always deliberate. It needs full mode on the target. Under a strict profile policy, promoting into a profile that isn't the active one needs a person at a terminal to type its name back.

Together, these give you sandbox-to-production promotion with a diff someone reviewed, which is the piece we have wanted most on multi-environment Celigo projects.

Where we would start

This is our recommendation, not Celigo's. Roll it out in three steps rather than giving an agent full access on day one:

1. Read-only triage in chat. Connect Platform MCP to a sandbox, or to production with a read-scoped token, and use it for "where are my errors?" and account health audits. That alone saves time on the most common Celigo support work. See our guide to a Celigo integration that isn't syncing for what to look for.
2. Operational actions with confirmation. Allow retries and error resolution, with the agent showing what it will retry first. These change destination systems such as NetSuite, so treat them as writes.
3. Structural changes through the CLI and review. New flows, mapping changes and deletes go through pull, a pull request and push, not a chat window. That keeps a record of every change and a person who approved it.

Frequently Asked Questions

What is Celigo Platform MCP? A hosted MCP server from Celigo that lets AI clients such as Claude, ChatGPT, Gemini, Cursor and VS Code read, build, run and troubleshoot an integrator.io account in plain language. It wraps the Celigo REST API, needs nothing installed, and became generally available on June 18, 2026.

What is the Celigo CLI? Celigo's first-party command-line tool, @celigo/celigo-cli on npm. It needs Node.js 22+, works with profiles for several accounts and regions, and can pull an account into files for git review and push changes back.

Is Platform MCP the same as the Celigo MCP Server? No. Platform MCP lets an agent operate your Celigo account. The Celigo MCP Server (mcpServers resource) is something you build to expose your own tools to AI clients. Celigo's docs describe them as separate things.

Can an AI agent delete integrations through Platform MCP? Yes, if the signed-in user or token is allowed to. delete_resource reports dependents as warnings but always proceeds. Limit this with a scoped token, a sandbox environment and an AI client that asks before destructive calls.

How do I limit what an agent can change in Celigo? Give it a custom-scoped or personal access token rather than a full-access one, bind it to a sandbox environment, run CLI profiles in read or operate mode, and review the audit log filtered by source mcp or cli.

Which AI clients work with Celigo Platform MCP? Any MCP client that supports Streamable HTTP. For OAuth sign-in, Celigo lists current releases of Claude, Claude Code, Cursor, VS Code, Windsurf, Grok Bot, ChatGPT, Codex and Gemini CLI. Clients without OAuth support connect with an API token.

Entech Solutions is a Celigo integration partner. We build and support Celigo integrations for NetSuite, Shopify, Salesforce and EDI, and we set up AI access to them with the scoping and review steps above. See our AI Agents & MCP page, or talk to us before you connect an agent to a production account.

Sources, checked November 3, 2026: Celigo Developer Platform; Platform MCP overview, tools, connect a client and use cases; Celigo CLI, profiles and permission modes, the local tree, push and promote; 2026 changelog; @celigo/celigo-cli on npm. Both tools ship updates every few weeks, so check the changelog for anything newer.