The CEO Juice MCP Server lets your team ask questions about your business data in plain language and get contextual, accurate answers back. It runs as a cloud service connected to your data through a secure Cloudflare Tunnel, and it is built on Juice's 20-year library of e-automate process logic.
Jump to a specific section by clicking a link
Overview | Action Needed to Get Started | Samples | Accessing App | App Functionality | Best Practices & Tips | Related Alerts
Overview
Overview
As AI agents start to take work away from humans, and we move toward a world where AI agents can take action, it becomes important to put rules around what the agent can do as well as what resources are available to it. That framework is called an MCP server (Model Context Protocol), and Juice is building one for our clients.
Office Technology companies ask questions about their business data in plain language and receive intelligent, contextual answers. The platform is built on Juice's 20-year library of e-automate process logic and learns each dealer's operational patterns over time.
The MCP Server is armed with tools that can look in your DCA, your CRM, your marketing platform and elsewhere to provide the single pane view that Gary blogged about in July '24 (phase 2). We plan to integrate our subscription site so agents can, with your approval, add additional Juice processes as needed.
This is a cloud solution built around a secure Cloudflare Tunnel. Your data stays in your database. The tunnel gives the MCP Server a read-only path to it with no inbound firewall ports opened. See the security document attached to the bottom of this article for the full detail.
The future is API to API, agent to agent. Today websites are designed for humans. You need to get your company ready for agents.
WARNING – Intended for C-Level Users
The MCP Server is intended for C-Level or similar senior users. It can query sensitive data that is meant only for high-level users, so distribute access to the MCP Server accordingly. The current version does not restrict access by table, so anyone connected can ask about any data the read-only SQL Login can see. Future versions will add permission levels to restrict access to certain tables.
Ready to start? Jump to Action Needed to Get Started.
* * *
Action Needed to Get Started
Action Needed to Get Started
There are three steps to stand up the MCP Server for your tenant. How Steps 1 and 2 work depends on whether your e-automate SQL Server is on-premises or hosted by ECI.
Step 1 – Create a Read-Only SQL Login
The MCP Server connects to your database with a dedicated SQL Login. It needs read-only access to two databases:
1. Your EA (e-automate) database
2. Your CEOJuice database
Assign the db_datareader role on both of those databases. No other permissions are necessary: no write access, no server roles, and no access to any other database.
The name of the login doesn't really matter, but it should be clear what it's for. Something like ReadLLM, CEOJuiceReadOnly, or whatever makes sense for the MCP at your company.
To send us the password, use https://secret.ceojuice.com to generate a secure, single-use link. Never email a password in plain text.
If your SQL Server is on-premises: your own IT staff or DBA creates the login directly in SQL Server Management Studio, assigns db_datareader on the two databases above, and sends us the login name and the secure password link.
If you are ECI hosted: you do not have the access to create the login yourself, so CEO Juice will reach out to ECI to request a new read-only SQL Login with db_datareader on your EA database and your CEOJuice database, and nothing else. There is no ticket for you to open. ECI hosted clients also need a machine to run the Cloudflare Tunnel. See ECI Hosted – Cloudflare Tunnel Host below.
Step 2 – Juice Runs Initialization and Installs the Cloudflare Tunnel
Once we have the new SQL Login, we start the initialization process and install the Cloudflare Tunnel connector on your Juicebox. CEO Juice handles this step. No firewall changes and no inbound ports are required on your side, because the tunnel makes an outbound connection only.
ECI Hosted – Cloudflare Tunnel Host
Because your SQL Server lives in ECI's data center, the Cloudflare Tunnel needs to run on a machine on your network that can reach ECI's SQL Server.
If you already use our Power BI reports: we will install the Cloudflare Tunnel on the same machine that runs your Power BI connection. Nothing new is needed on your side.
If you do not use our Power BI reports: you will need to provide a server on your network that is always on. That server must sit on a network with a static public IP address. Dynamic IP addresses assigned by your ISP will not work, because ECI needs to whitelist that IP address to allow connections to their SQL Server.
Step 3 – Connect the MCP Server to Your LLM
After the tunnel is up, CEO Juice sends an authentication token your users need to connect the MCP Server to the LLM your company uses. We send the token only to your C-Level executive, President, Owner, or similar, and that person decides who at your company receives it. We'll walk your team through the connection and confirm the first few questions return the answers you expect.
* * *
Sample
Sample
ID588 CEO Juice MCP Server Webinar (Recorded 8/6/26)
* * *
Accessing App
Accessing App
Access to the MCP Server is through the LLM client your company connects in Step 3 above. Once connected, your users ask questions in plain language from that client. There is no separate CEO Juice portal screen to log into.
Security and data handling detail is covered in the CEOJuice MCP - Security & Data Handling PDF attached at the bottom of this article.
* * *
App Functionality
App Functionality
1. A user asks a question in plain language from the connected LLM client. For example, a user might ask which contracts are running over their allowed overage rate, or which service calls have been open longest by branch.
2. The MCP Server determines which of its tools answers that question and builds the query. The tools are defined by Juice and are the only operations the agent can perform. The agent cannot run arbitrary commands against your database.
3. The query travels to your environment over the Cloudflare Tunnel installed on your Juicebox (or tunnel host machine for ECI hosted clients) and runs against your EA and CEOJuice databases using the read-only SQL Login created in Step 1.
4. Results come back through the same tunnel and the LLM explains them in plain language, using Juice's 20-year library of e-automate process logic for context on how the data is actually used in an Office Technology company.
5. In the current version, because the SQL Login holds db_datareader and nothing more, every operation is a read. The MCP Server cannot write to, change, or delete anything in your e-automate data.
6. Phase 2 will include some write capabilities through ID136 Juice API for e-automate. Any write actions will be limited to what ID136 allows.
* * *
Best Practices & Tips
Best Practices & Tips
1. Create the SQL Login specifically for the MCP Server. Do not reuse an existing service account. A dedicated login means you can see exactly what the MCP did and disable it independently at any time.
2. Keep the login at db_datareader on the EA and CEOJuice databases only. If someone adds db_owner or sysadmin "to make it easier," that removes the guarantee that the agent can only read.
3. Name the login so the next person understands it. Use ReadLLM or CEOJuiceReadOnly rather than something generic that gets cleaned up by mistake during an audit.
4. Always send credentials through secret.ceojuice.com. The link expires after it is read once, so the password never sits in an inbox.
5. ECI hosted clients: if you are not already using our Power BI reports, line up the always-on server and confirm your static public IP address early. ECI has to whitelist that IP before the tunnel can connect, and that request typically takes longer than anything else in the setup.
6. Answers are only as good as the data behind them. If your e-automate data has known gaps, such as equipment not tied to contracts or inconsistent branch assignment, expect the agent to surface those gaps, and treat that as a cleanup list rather than a defect.
7. Review the attached security document with whoever owns IT security at your company before the kickoff call. It answers most of what they will ask.
8. The Cloudflare Tunnel makes an outbound connection only, so no inbound ports need to be opened. However, if your firewall blocks outbound connections, you may need to allow the ports Cloudflare lists in Configure Cloudflare Tunnel with a firewall.
* * *
Related Alerts
Related Alerts
Other IDs you may want to consider alongside the MCP Server.
ID74 - PBI Conversational Agent
ID136 - Juice API for e-automate
* * *
0 Comments