Setup Guide

Connecting Claude to NetSuite

By Brian Weisberg · June 2026

An end-to-end guide to the two-role OAuth setup for finance teams

This guide walks through connecting Claude to NetSuite so you can ask questions about your financial data and get answers directly—no logging into NetSuite, no writing queries, no manual exports.

Once connected, you can ask things like "how much did we spend with this vendor last year?" or "what's the deferred revenue balance for this customer?" and Claude will query NetSuite and return the answer in plain language, a table, or a formatted report. The connection runs through something called an MCP integration. You don't need to understand the underlying technology to use it—this guide covers everything you need.

Before you start

Check that the NetSuite AI Connector SuiteApp is installed: Customization → SuiteCloud → Installed SuiteApps, look for com.netsuite.mcpstandardtools. It should show Status: COMPLETE. If it's not installed, go to the SuiteApp Marketplace and search for it by name before continuing.

What you can do with this

Three examples to get your wheels turning. The right use cases depend on your business, but the pattern is consistent: ask a question in plain language, Claude queries NetSuite, you get something ready to share or act on.

Use case 01

Revenue movements reconciliation

If you work with deferred revenue—annual contracts, prepaid arrangements, usage-based billing—it's hard to get a clear picture of how money is moving at any point in time. Claude can pull a month-by-month view showing how revenue is loading into deferred, releasing into recognized, and what the ending balance looks like. Run it for the whole business or for a specific customer.

A typical output: a waterfall table (deferred loaded, released, ending balance by month), a transaction-level trace from invoice through recognition, and a findings section flagging anything off—like a balance that should have cleared at contract termination but didn't.

Tip: Ask Claude to include a math check confirming every ending balance ties back to the underlying arithmetic. Easy to add, catches rounding errors before they make it into something you share.

Use case 02

Vendor spend analysis

Vendor spend can be deceptively messy in NetSuite. The same vendor might appear under different names across bills. Some vendors route through a spend management platform (Ramp, Navan, Brex), which means they show up as a single vendor with the actual vendor buried in a memo field. Others route through a marketplace, invisible unless you know where to look.

Claude can learn these patterns. Once you show it how your vendors are recorded, for example "this vendor always comes through as the platform with the name in the memo," it applies that logic consistently. The result is a spend picture that reflects reality, not just whatever's in the vendor field.

Tip: The first time you run a vendor spend query, ask Claude to show you a sample of raw transaction data before it aggregates anything. Easy way to spot non-obvious mappings before they roll up into a wrong total.

Use case 03

Per-employee benefit and stipend tracking

If your company offers benefits employees draw on over time—L&D stipends, wellness budgets, home office allowances—and those transactions flow through NetSuite in any form, Claude can extract and organize them by person. A useful output: each employee's YTD usage broken down by category, with transaction-level detail on demand. Useful for answering "who has used their full allocation?" without compiling spreadsheets manually.

Tip: Employee names in NetSuite memos are often inconsistent—nicknames, initials, misspellings. Ask Claude to show you the distinct name variations it finds before attributing spend, so you can confirm the mapping is right. It gets even easier if you have a public or internal page that lists your team—Claude picks up on it and learns how you want employee names represented, or how teams are structured.

The security architecture

The setup involves creating a dedicated read-only role in NetSuite for Claude to authenticate as. The reason matters.

Claude's NetSuite integration includes tools that can create and update records, not just read them. If Claude is authenticated with a role that has write permissions, it could theoretically create transactions, edit customer records, or modify other data in your ledger. To prevent that, we create a read-only role and configure Claude to use it. No write permissions on the role means NetSuite blocks any write attempt at the permission level—regardless of what Claude tries to do. The protection is enforced by NetSuite, not by hoping Claude behaves.

One thing that trips people up

When you connect Claude, you need to be logged into NetSuite under your normal working role—not the new read-only role you're about to create. You'll select the read-only role on a screen that appears during the connection flow. More on this in Part 2.

Part 1—NetSuite setup

You need Administrator access for these steps, or ask your NetSuite admin to complete them.

Confirm the SuiteApp is installed

Go to Customization → SuiteCloud → Installed SuiteApps. Look for NetSuite AI Connector Service (bundle ID: com.netsuite.mcpstandardtools). Confirm it shows Status: COMPLETE. If it's not there, install it from the SuiteApp Marketplace before continuing.

Create the read-only "Netsuite MCP" role

Go to Setup → Users/Roles → Manage Roles → New. Name it Netsuite MCP (this name appears on the authorization screen when you connect Claude). Check Web Services Only Role—this prevents anyone from using this role to log into NetSuite directly and ensures it appears correctly during the connection flow.

On the Permissions tab → Setup subtab, add these six permissions at Full level:

Permission	Level
MCP Server Connection	Full
REST Web Services	Full
Log in using OAuth 2.0 Access Tokens	Full
Log in using Access Tokens	Full
User Access Tokens	Full
SuiteScript	Full

Save the role. Do not add any permissions related to creating, editing, approving, or posting transactions. This role should stay read-only.

Known issue

The Web Services Only Role checkbox is easy to miss but critical. Without it, the role may not show up correctly during the connection flow, and you may see a "does not support OAuth 2.0 login" error.

Assign the role to your user account

Go to Lists → Employees → Employees. Find and open your employee record. Click the Access tab, find the Roles section, and add Netsuite MCP. Save. You'll now see Netsuite MCP in the role selector in the top-right corner of NetSuite—though you won't need to switch into it during normal use.

A note on the integration record (no action needed)

If you look at the integration record Claude uses (Setup → Integration → Manage Integrations, look for "NetSuite AI Connector Service"), you'll notice the REST Web Services checkbox is greyed out and can't be checked. That's normal—Anthropic created this integration and its settings are locked. Don't try to edit it. The role you created in Step 2 is what gives Claude the access it needs.

Part 2—Connecting Claude

NetSuite is set up. This part takes about two minutes per person.

Make sure you're in the right NetSuite role first

Before going to Claude, check which role you're currently in on the NetSuite side. You need to be logged in under your normal working role—not the Netsuite MCP role you just created. Netsuite MCP is what you'll select during the connection flow, not what you're already in. Check the role indicator in the top-right corner of NetSuite. If it says Netsuite MCP, switch to your normal role first.

Most common mistake when reconnecting

Going straight to Claude without checking your NetSuite role first. Always confirm you're in your normal working role in NetSuite before clicking Connect in Claude. This step catches more than half of all connection failures.

Connect NetSuite in Claude

In Claude, go to Settings → Connectors. Find NetSuite and click Connect. A NetSuite page will open asking you to authorize the connection. On the role selector, choose Netsuite MCP. Click Authorize. You'll be brought back to Claude automatically.

Test that it works

The NetSuite connector in Claude should now show as connected. Confirm it's actually working with a simple test: "Run a quick NetSuite query to confirm the connection is working—just pull the first 3 rows from the transaction table." If Claude returns a few rows, you're set. If it says the tools are unavailable, see Troubleshooting below.

Note: The connection is per person, not shared. Each person who wants to use Claude with NetSuite needs to go through setup themselves and connect their own Claude account. If a colleague's connection is working, that tells you nothing about whether yours is.

Tips for getting good results

Ask for everything, not just bills

When you ask Claude to look something up, it may default to querying only vendor bills or invoices. This can miss a lot. Journal entries are a separate transaction type—and many common workflows post through JEs: month-end accruals, prepayment amortizations, corporate card programs. A query limited to vendor bills misses them entirely.

Sanity check for any spend query

Ask Claude to first pull a grand total with no filters other than the account and date range, then compare against the detailed results. If they don't match, something is being filtered out. The discrepancy tells you what to investigate next.

Filter at the line level, not the header

Revenue recognition journal entries are often posted as a single large entry covering many customers at once. The customer is recorded at the line level inside the entry, not on the entry itself. If Claude filters at the wrong level, it can return results for a completely different customer—or nothing at all.

If results for a customer look wrong—too high, too low, or zero when you know there should be activity—ask Claude: "Are you filtering on the transaction line entity, not the transaction header entity?" That question catches the most common mistake.

If you get zero results, pull an unfiltered sample first

Zero results almost always mean a filter is wrong, not that the data is missing. Ask Claude to run a quick sample: "Can you pull 5–10 raw rows with no filters so we can see what's actually there?" This almost always reveals the issue—a filter too narrow, a date range that doesn't match, or a field with data in a slightly different format than expected.

Claude can run saved searches, not create them

Claude can run existing saved searches and list available ones. It can't create new ones. If you need a new saved search built, ask Claude what criteria and columns to use, then create it yourself: Reports → Saved Searches → New → Transaction.

Troubleshooting

Error / symptom	Cause	Fix
"This connector has no tools available"	Usually a stale session, not a permissions problem	Open a new Claude conversation first. If that fails, go to Settings → Connectors, disconnect NetSuite, and reconnect—making sure to select Netsuite MCP on the authorization screen.
"Your role does not support OAuth 2.0 login"	You're logged into NetSuite under a role that can't initiate the connection flow—often happens when you're already in the Netsuite MCP role	Switch to your normal working role in NetSuite first, then go back to Claude and connect. Select Netsuite MCP on the authorization screen.
Netsuite MCP doesn't appear as an option on the authorization screen	Role hasn't been assigned to your user yet, or Web Services Only Role isn't checked	Ask your NetSuite admin to assign Netsuite MCP to your employee record and confirm Web Services Only Role is checked on the role definition.
Connection keeps dropping	Normal—the connection doesn't stay active indefinitely	Open a new Claude conversation. Fixes it most of the time. If not, go to Settings → Connectors, disconnect, and reconnect.
Can't find a Claude token in NetSuite's Access Tokens list	Expected—the connection uses a different token type that doesn't appear there	Nothing to do. Its absence from that list doesn't mean anything is wrong.
Totals look wrong or suspiciously large	Often filtering at the transaction header instead of the line entity on large journal entries	Ask Claude: "Are you filtering on the transaction line entity, not the header?" Then ask it to pull an unfiltered sample to verify.

When the connection drops

The connection between Claude and NetSuite drops periodically. This is normal and doesn't mean anything is misconfigured. Try this first: open a new Claude conversation. The connection re-establishes on a new session most of the time.

If a new conversation doesn't fix it: go to Customize (bottom-left of the chat window) or Settings → Connectors. Find NetSuite, click Disconnect, then Connect. On the NetSuite authorization screen, confirm you're in your normal working role, then select Netsuite MCP and authorize. Test with a quick query.

📋 Quick reference

First-time setup (done once, by your NetSuite admin)

Install the NetSuite AI Connector SuiteApp (com.netsuite.mcpstandardtools)
Create the Netsuite MCP role: Web Services Only Role checked, 6 permissions at Full, no write access
Assign the role to each user who will connect Claude

Connecting Claude (done once per person)

In NetSuite, confirm you're logged in under your normal working role
In Claude → Settings → Connectors, click Connect next to NetSuite
On the authorization screen, select Netsuite MCP
Test with a quick query to confirm it's working

If the connection drops

Open a new Claude conversation and try again—fixes it most of the time
If that doesn't work: confirm your NetSuite role, then go to Customize or Settings → Connectors in Claude and reconnect

If results look wrong

Ask Claude if it's including journal entries, not just bills
Ask Claude if it's filtering on the transaction line entity (not the transaction header)
Ask Claude to pull a small unfiltered sample to see what's actually in the data

Brian Weisberg is a tech CFO writing about finance leadership, AI adoption, and building finance teams that compound. More writing →