Munin MCP
UADiscuss on Telegram

How it works

A technical overview for IT, security and anyone approving the connection: the parties involved, the path of a request, protection, data, load and database requirements.

In brief

An AI agent reads your 1C:Enterprise data with the user’s own rights, and every call is logged

Munin MCP connects a 1C:Enterprise database to an AI agent such as Claude or ChatGPT. A manager or finance lead asks the agent a question in plain language. The agent finds the right reports and data in 1C:Enterprise and says where every figure comes from. An extension is installed in the database; the main configuration stays unchanged.

1C:Enterprise is a low-code business platform behind ERP and accounting systems used by over 1.5 million companies.

Management questions get answered in a conversation with the agent, and each figure can be checked against a 1C:Enterprise report.

Four guarantees

  • Read-only

    There are no write tools. Both the gateway and the extension in the database reject any request that changes data.

  • The 1C user's own rights

    The agent acts on behalf of the user who connected it and sees no more than that user. The platform enforces the rights, and the user's restriction profile narrows them further.

  • Data stays in 1C:Enterprise

    Data is stored in your database. The gateway passes what was read to the agent and keeps data no longer than it takes to deliver the answer. The log holds no data values.

  • Every call is logged

    The gateway records who called, from which agent, which database and tool, and with what result. The log holds no data values.

The gateway is hosted in Hetzner Cloud, Helsinki, Finland (EU). Agents sign in with OAuth 2.1, and every connection is encrypted with TLS.

Who connects to whom

Three parties, and your database always opens the connection

The agent connects to the Munin gateway at a regular address. The 1C:Enterprise database opens a secure connection to the gateway itself, so nothing on the 1C server is exposed to the outside.

  • Nothing on the 1C server is exposed to the outside
  • No VPN, no web publishing of the database

The path of one request

From question to answer in five steps

You ask the agent. The agent picks a tool, the gateway checks access and limits, 1C:Enterprise runs the call in your name with your rights, and the answer comes back with its source and caveats.

Why a gateway

The gateway guides the agent, so the database receives only the data query

Why doesn't the agent talk to the database directly? Here is how it handles the request “show stock at the main warehouse”.

User's request “Show stock at the main warehouse”

What this gives you

  • Less context, fewer tokens

    The agent does not pull the whole database structure into its context. It takes only the slice it needs, which saves model context and token cost.

  • Less load on the database

    The database hands its structure description to the gateway once after each configuration change. From then on, the gateway answers questions about the structure, and the database receives only data queries.

  • Errors fixed without a person

    A query error comes back with the correct field names, so the agent corrects the query on its own.

The gateway keeps gaining capabilities: new knowledge and guidance for the agent appear on the gateway without updating your database.

Who you are to the system

The agent acts in your name without ever knowing your password

Munin has no user accounts of its own. Your 1C:Enterprise account decides who you are and what you may see.

How the agent signs in

  1. You add the database address to your agent. The agent opens the Munin sign-in page, which shows a short one-time code.

  2. You enter the code in the “Connect AI” form in your 1C:Enterprise. The form shows which agent is asking for access.

  3. You click “Allow”. The agent gets access to this database only, and only in your name.

  • OAuth 2.1

    Agents sign in only with OAuth 2.1; there are no static access keys. A sign-in code is valid for 5 minutes and works once. You choose how long the connection lasts; the default is 90 days.

  • Your 1C password never leaves the database

    Sign-in does not transmit the password at all. Neither the agent nor Munin ever sees it.

  • The “Work with AI” role

    Only a user who was given this role by the person in charge of the database can connect an agent.

  • Restriction profile

    In the “Connect AI” form the user hides objects and fields, keeps only the companies or warehouses needed, and caps the number of rows. The profile can only narrow the user's rights.

Protection

Why the agent cannot break anything

Several independent layers of protection hold the agent back. Each works on its own and does not rely on the others.

  • No write tools

    None of the agent's tools changes data. Both the gateway and the extension in the database reject any request to change it.

  • Queries are read-only and checked

    An agent query runs read-only, with a time and row limit. Both the gateway and the extension in the database check it, and a query that fails the check does not run.

  • Platform safe mode

    The code that runs agent tools works in the 1C:Enterprise platform's safe mode and never gets privileged mode.

  • The user's rights and RLS

    Data is read in the user's session, so the platform applies that user's roles and record-level security (RLS). The restriction profile narrows them further.

The agent reads data only through the 1C:Enterprise platform. It has no direct access to the database server.

Agent tools

Five kinds of tools, all read-only

The agent sees a small set of general tools. They work with 1C:Enterprise configurations that meet the requirements below, and add-ons for a specific configuration add knowledge about it.

  • Help

    An overview of the database, where to start, and guidance by topic: sales and margin, cash, stock, debts, the query language.

    help

  • Reports

    Standard reports available to the user, with period and filters. The agent tries them first.

    report_listreport_run

  • Search and records

    Search across catalogs and documents by name, code, number or period; a record card with its attributes and register movements.

    object_findobject_get

  • Structure

    Find database objects by name or synonym and see how they are built: fields, virtual tables, parameters.

    meta_searchmeta_describe

  • Read-only queries

    A custom query in the 1C query language when no report fits. Read-only, with a row and time limit, and the answer says the figure did not come from a standard report.

    query_run

Data

Where each kind of data lives

Data is stored in your database. The gateway keeps data no longer than it takes to deliver the answer; it holds only what sign-in, a log without data values and guiding the agent require. The AI provider sees only what the agent read for the answer.

  • Every connection is encrypted with TLS: HTTPS between the agent and the gateway, a secure WebSocket between the database and the gateway.
  • That is why the restriction profile matters: whatever it hides never reaches the model.

Load and licences

How much load the agent puts on the database

The agent works alongside your regular 1C:Enterprise users, so its load is capped on both sides: at the gateway and in the database.

  • Quiet when idle

    While the agent asks nothing, the database keeps one connection to the gateway, with no sessions and no background jobs.

  • Limits on every call

    Every call has a timeout and a row limit.

  • One heavy call at a time

    The database runs no more than one heavy agent call at a time.

  • A licence, like a normal sign-in

    While the agent works, the database opens a session in the user's name, and it takes one of your licences. After a few minutes without calls the session closes by itself.

  • First call after a pause

    After a pause the first answer takes a few seconds while the session opens.

Control

How to switch the agent off

You switch the agent off from inside 1C:Enterprise, without contacting us.

  • Revoke your own connection

    In the “Connect AI” form the user sees their active connections (agent, date, last activity) and revokes any of them.

  • AI switch for the whole database

    A user with full rights turns AI off for the database with one checkbox: agent connections close and no new ones open.

  • Blocking in 1C:Enterprise

    A user who is blocked or deleted in 1C:Enterprise loses agent access. The gateway checks this with the database regularly.

  • Call log

    Every call is recorded: who, from which agent, to which database, with which tool, with what result and how long it took.

Requirements

What your database needs

  • 1C:Enterprise platform 8.3.27 or later
  • A configuration on managed forms with the Standard Subsystems Library 3.1 or later
  • Your hosting provider or administrator installs the extension; the main configuration stays unchanged
  • An outbound connection from the 1C:Enterprise server to the gateway; no inbound ports or web publishing
  • An AI agent that supports MCP and OAuth 2.1 sign-in: Claude, ChatGPT or your own

The Standard Subsystems Library is the common 1C foundation for users, access groups and updates in business configurations.

Questions from your IT or security team?

Message us on Telegram: we will answer questions about protection, data and requirements, and tell you what your configuration needs.

Discuss on Telegram