Concepts

Firm ceiling and personal grants

Access is set in two layers. A firm administrator decides in Settings → AI Agent Access which permissions an agent may have at all; that is the ceiling for the whole firm. Each person then chooses what to allow within it when they connect their own assistant. See Capabilities for what each permission covers.

A connection carries the access of the person who made it. An assistant cannot see anything that person could not see by signing in to LeanLaw.

MCP server and REST API

The MCP server at https://api.leanlaw.io/mcp exposes the same operations as the REST API, plus some higher-level ones that combine several API calls into a single action. Connect and the client will list what is available.

An agent can also use the REST API directly, without MCP — see OpenAPI.

Connectors and skills

The connector gives an assistant access to your data. Skills tell it how to carry out a specific piece of your firm's workflow with that access — see Skills.

Ending a connection

Anyone at the firm can disconnect their own assistant from within it by removing the LeanLaw connector — see Claude.

To end connections centrally, or to turn off agent access for the whole firm, an administrator opens Settings → AI Agent Access and disables the agent. It takes effect within seconds, including for assistants that are currently connected.

Building your own integration

If you are building an app rather than connecting an assistant, get in touch at [email protected]. We will register it and walk you through the OAuth setup — it uses the authorization code flow with PKCE, and one connection covers both the MCP server and the REST API.

For server-to-server integrations with no individual user behind them, an API key is usually the better fit — see Authentication.