Set up NetSuite (New setup)

Set up NetSuite indexing and optionally connect NetSuite Model Context Protocol (MCP) tools in one flow. Configure indexing first, then connect or skip tools before reviewing setup.

You're reading the new setupDoes your instance use the previous setup? →

Indexing is required in this flow. Indexing and MCP use separate NetSuite integrations and credentials:

Connection	Credentials	Purpose
Indexing	Machine-to-machine OAuth client ID, certificate ID, X.509 certificate, and private key	Crawl NetSuite content and permission data
MCP tools	Separate OAuth client ID and client secret	Let each user authorize live tools with their own non-admin NetSuite role

Prerequisites

Before you begin:

• Have access to the Glean Admin console with permission to configure connectors and, if you plan to use MCP, tools.
• Have NetSuite Administrator access to prepare the indexing integration and, if needed, the MCP integration and roles.
• Enable REST Web Services and OAuth 2.0 in NetSuite.
• Prepare the indexing integration, certificate and private key pair, client ID, and certificate ID. Complete the NetSuite preparation in steps 1 through 4 of NetSuite search integration, then return to this guide before configuring Glean.

MCP preparation is optional. Complete it during Connect tools (optional) using the callback URL shown in Glean.

Set up indexing

Add the connector and enter the credentials for the indexing integration:

1. In the Glean Admin console, go to Connectors, click Add connector, and select NetSuite.

2. On Set up indexing, enter a name for the connector.

3. Enter the following values:

   Field	Value
   Account ID	The account ID from your NetSuite account URL, such as 12345 for production or 12345-sb1 for a sandbox. Use the hyphenated URL form, not an underscore.
   Client ID	The client ID of the machine-to-machine indexing integration
   Certificate ID	The ID from the certificate mapping in NetSuite
   Excluded Role IDs	(Optional) A comma-separated list of numeric role IDs to exclude from crawling, such as 3, 5, 10

4. Click Upload Certificate File and upload the X.509 certificate as a .crt file.

5. Click Upload Private Key File and upload the matching .key file.

6. Click Continue.

Excluding a role also excludes its permission data. Users cannot gain access to indexed NetSuite records through an excluded role. See Exclude roles from crawling.

(Optional) Connect tools

To continue without MCP, click Skip on Connect tools (optional) and proceed to Review setup. You do not need MCP credentials to skip this step. You can connect tools later through Edit setup.

To connect MCP now:

1. Confirm that NetSuite account ID shows the account you configured for indexing. MCP uses this saved account and environment.
2. Copy the Callback URL shown in Glean.
3. Complete the NetSuite preparation in steps 1 through 5 of NetSuite MCP. Those steps enable the required features, install the MCP Standard Tools SuiteApp, prepare a non-admin role, and create a separate OAuth integration.
4. On the MCP integration record in NetSuite, set Redirect URI to the exact Callback URL from Glean. Enable Authorization Code Grant and Public Client, and select only the NetSuite AI Connector Service OAuth scope (mcp). Do not enable Client Credentials (Machine to Machine) Grant or reuse the indexing integration.
5. Enter the separate integration's credentials in MCP client ID and MCP client secret in Glean.
6. Click Connect and authorize with the prepared non-admin role for the displayed NetSuite account.

important

The MCP role needs MCP Server Connection and Log in using OAuth 2.0 Access Tokens permissions. The SuiteApp's record tools also need the REST Web Services role permission and access to the intended records and fields. These permissions are separate from the MCP integration's OAuth scope.

If the connector already has a linked MCP server, Glean locks Account ID. Create a separate NetSuite connector to use a different account or environment.

Review setup and begin indexing

Complete the final stage after configuring indexing and connecting or skipping MCP:

1. On Review setup, choose who can access indexed NetSuite content in Glean. This setting does not grant NetSuite permissions the user does not already have.
2. Click Begin indexing to start the crawl.

If Skip for now appears, you can defer the crawl and start it later from the connector. This does not make indexing configuration optional. Skip on the tools step skips MCP authorization, while Skip for now on the review step defers indexing.

Review tool access

If you connected MCP, open the connector's Tools tab and review the synced tools and user access. Enable only the tools your users need. Each user authorizes with their own eligible non-admin NetSuite role.

Connecting MCP does not mean you should enable write access. To keep access read-only, enable only read tools and leave Create Record and Update Record turned off. Review any additional tools available in your NetSuite account. See Write tools.

Verify the connection

Check indexing and MCP independently:

1. After Glean indexes content, search for a NetSuite record that the test user can access, such as an invoice or customer record.
2. Confirm that indexed results reflect the user's NetSuite permissions.
3. If you connected MCP, run an enabled read tool with a user whose NetSuite role has access to the requested records. Check the tool result to confirm a live MCP call succeeded. An answer containing indexed Glean content does not prove that MCP worked.

Connect tools later or update setup

Open the NetSuite connector and click Edit setup to return to the unified flow. If you skipped MCP, open Connect tools (optional) and complete the separate OAuth integration and authorization.

Keep indexing credentials and MCP credentials separate when updating them. A linked MCP server must continue to use the connector's saved NetSuite account and environment.

Troubleshooting

Use these checks for setup failures:

• If indexing authentication fails, verify the indexing integration, certificate mapping, client ID, and certificate ID. Confirm that the .crt and .key files form a matching pair.
• If MCP reports an invalid login attempt, compare the integration record's Redirect URI with the Callback URL in Glean. The scheme, host, path, and trailing slash must match.
• If MCP reports access denied, verify the non-admin role's permissions and access to the SuiteApp folder in the NetSuite File Cabinet.
• If record tools fail, verify the REST Web Services account feature, the role permission, and access to the requested record types and fields.

For additional MCP checks, see NetSuite MCP troubleshooting.