Your own Claude, wired into your store.

One connector URL. Every teammate signs in as themselves, and the server checks their role again on every single call, not just at login. A marketing teammate’s Claude sees campaigns and intelligence. A support teammate’s sees orders and tickets. Neither sees the other’s, even if you hand that same link to your whole team.

LaunchingSovereign tierRe-checked on every call, not just at sign-in

Store connector for Claude

Settings → Claude connector

Launching
URLmcp.charvax.com/yourstore
Each teammate connects & signs in as themselves

A preview of the control you’ll have. It goes real once role enforcement ships end-to-end (below).

Publish it once. Every teammate still gets their own Claude.

On Claude Team or Enterprise, your admin can push the connector to everyone at once. It doesn’t matter. Each person signs in as themselves, and the store hands back only what their role already sees in the admin sidebar.

mcp.charvax.com/yourstoreone connector URL: add it once, or push it to the whole team

The scope is re-checked server-side on every tool call rather than cached at sign-in. Ask for anything outside the highlighted scope and the answer is a decline, not a guess.

Ask it something outside your lane, and watch it say no.

The same connector, the same store, two different mornings. Marketing gets a grounded, ready-to-review draft. Support gets today’s shipping exceptions. And when the same person asks something Support was never allowed to see, the answer is a decline, not a partial peek.

The decline doesn’t dead-end, either. It lands in your store’s access-request inbox, the same place your in-admin Copilot’s out-of-scope asks go.

claude · charvax-connectorTwo teammates, one morning

rahul · role: marketing

> Draft a win-back message for anyone who’s gone quiet.

◆ find_customer → 3 customers idle 45+ days

◆ draft_winback → 3 drafts, capped by the offer engine

Three drafts, sized to their segment. Nothing sends until your team hits send.

kavya · role: support

> Any shipping exceptions today?

◆ shipping_exceptions → 1 NDR, retry window closes 6pm

> What’s our best-performing segment this month?

◆ customer_segments → blocked — outside support’s scope

That’s outside what I can see from here. I’ve sent a request to your store owner.

Reads are always on. Writes are your call.

Five read tools ship the moment you turn the connector on. The two write tools (a draft, a toggle) stay off until you flip the store-level switch, and even then nothing sends itself.

Read
get_todays_numbers

Orders, revenue and AOV, so far today.

Read
find_customer

Look up a customer and their order history.

Read
low_on_stock

Variants under their reorder threshold.

Read
open_tickets

Support tickets waiting on a reply.

Read
shipping_exceptions

NDR, RTO and unserviceable-pincode alerts.

Write · gated
draft_winback

Drafts a win-back message; a human still sends it.

Write · gated
toggle_agent

Turns a store agent on or off, within scope.

One switch for the store. One card for each person.

You turn it on, choose which roles may connect, and can revoke anyone instantly. Every teammate gets their own “Your connected Claude” card on their profile — connect, see your own scope, disconnect.

Who can connect

Write-actions off
  • Owner Always
  • Manager
  • Marketing
  • Support
  • Catalog

Connected Claudes · 2

Illustrative
  • AR

    Aditi Rao

    Manager · every dashboard — via Claude Desktop

    Revoke
  • RM

    Rahul Mehta

    Coupons · Intelligence · Customers — via claude.ai

    Revoke

Whatever a role can’t see in the dashboard, their Claude can’t see either. It’s enforced the same way, not a separate rulebook.

Your profile

Your connected Claude

RM

Rahul Mehta

Marketing · claude.ai

Your Claude can see

CouponsIntelligenceCustomers

Whatever it reads, it never sees a customer’s phone number, address, payment details or IDs — the AI receives a name and business signals, and the tools simply don’t emit the rest.

We won’t wire an outside Claude to a cosmetic lock.

Today, a role mostly changes what your sidebar shows rather than what the server allows. Shipping a real external connector on top of that would be a broken lock, not a feature. So this ships once, and only once, these are true:

Server-side role enforcement on every tool call — not just the sidebar (in progress, the prerequisite)
A mandatory security review, before a single external token is minted
Off by default, and every write stays behind your own switch — already true, shown above

This page is the plan we’re building to, not a claim we’re making today.

See the whole security posture
StaffedOperatedSovereign

Every channel. Your own Claude wired in.

Claude Connector ships in Sovereign, alongside Multichannel and Marketplace SEO — launching as the role-enforcement work above lands.