External Assistants

External assistants can receive read-only school information, including member photos, gallery files and billing details you are allowed to view. They cannot charge members, send messages, change records, or run workflows through this connection.

Only connect an assistant whose data handling you trust. Its provider may keep information outside Kanri. Disabling or revoking access stops future reads; it does not erase information already shared.

The connection can share more than individual member records: permitted reports, KPIs, workflow definitions, and descriptions of record fields can also leave Kanri. Review the assistant provider’s retention, training, deletion, and international-processing terms for the account you will use. Kanri’s own data-use commitments do not automatically apply to an external provider.

Confirm your school has authority to share the information, especially children’s details, health or sensitive notes, and family communications. A school setting or staff consent does not replace required member or guardian notices or consent. Access to several schools does not, by itself, authorize combining independently controlled schools’ information. See Kanri’s Privacy Policy and Service Agreement.

When documentation search is available, it sends your question to Kanri’s public-help search service. Ask focused product-help questions; do not include member details or private notes. The search index contains public guides, but the question itself is sent to the retrieval service.

Allow external assistants for your school

You need Manage Kai to change this setting. See Create a custom role.

Open your school’s Settings and select Kai.
Review the data-sharing warning.
Turn on Enable external assistants (MCP).
Click Save school setting.

Access is off by default. Kanri must also enable the service globally. Each staff member must separately consent and have Use Kai in each school. These settings do not grant extra member, billing, or reporting permissions.

Connect an assistant

Once access is available:

In your assistant’s integration settings, add a remote MCP connection.
Use https://app.kanrimemberships.com/mcp, not your school’s website address.
Start the assistant’s sign-in flow and sign in to Kanri.
Review the school selection and data-sharing details before allowing access.

The assistant must support remote Streamable HTTP MCP and browser-based OAuth sign-in. Kanri supports protocol revisions 2025-06-18, 2025-11-25, and 2026-07-28. The newer revision uses per-request discovery and metadata rather than an initialization handshake; your assistant handles this automatically if compatible. You do not need to copy a Kanri API key or access token. Do not paste passwords or tokens into a chat. Integration labels vary by assistant; no specific product is guaranteed supported.

After you allow access, your browser returns to the assistant. For desktop assistants, this may be a local address such as 127.0.0.1; keep the assistant running on the same computer. If you previously reached a blocked redirect, start a fresh connection from your assistant.

Ask for member information, reports, KPIs, or permitted school comparisons. The assistant can read only information your current permissions allow. Record information is data, not instructions to act: this connection cannot charge a member or perform any other change, even if an assistant claims otherwise.

Get student photos

You can ask a connected assistant whether a student has a profile photo, download the original image, or find files in that student’s member gallery. For example: “Check which of these new students have profile photos and download their original images for our welcome display.”

Name the school when you work with several schools. The connection must include each school, and your role must allow viewing basic member information. Checking or downloading a profile photo does not require gallery access.

Find and download gallery files

Connected assistants can search both the school gallery and member galleries, count matching files, and download original photos, videos and documents, including files in nested folders.

For example: “Find the competition photos in our school gallery” or “Download the grading photos and progress videos from this student’s gallery.”

Your role needs View Gallery, and gallery access must be enabled for the school. Member-gallery access also requires permission to view basic member information. Staff access can include private items; making a file public is not required. Deleted files, files in deleted folders and unfinished uploads are not available.

The assistant finds gallery entries through its normal record search, then uses the shared file-download tool (get_file) with the entry’s file reference. Profile photos use the same download tool. Knowing a file reference alone does not grant access to it. This connection cannot browse arbitrary stored files, upload files or change folders.

Ask the assistant to continue through all result pages when many files match. Download links expire after five minutes. Ask for a fresh link if a download expires. Downloads retrieve the original uploaded file, not a thumbnail. These file downloads are available through connected external assistants, not the built-in Kai chat.

When an assistant requests access, sign in to Kanri and review the unverified client name and callback location on the Connect to Kanri page. A displayed name is not proof of who operates the assistant.

Choose Only selected schools (up to 100) or All current and future eligible schools, then choose a Default school. For selected-school access, also check that school in the school list. The broad choice also covers schools you gain access to later, but only when those schools allow external assistants and your permissions permit access. Click Allow read-only access to connect, or Deny to refuse without choosing schools.

The default is used when a request does not name a school. If that school becomes unavailable, Kanri does not silently choose another.

If you see No schools available, ask a school administrator to enable external assistants under Settings > Kai and confirm your role includes Use Kai. Click Return to application to finish the unsuccessful attempt, then start a new connection after access is enabled. If a connection request cannot be verified or has expired, restart the connection from your assistant rather than resubmitting the old page.

Review or revoke your connections

Open your personal Settings.
Select External assistants (MCP).
Review each authorization, its school scope, and default school.
To stop future access, click Revoke connection.

Each connection shows Currently authorized granted schools. The All current and future schools warning stays visible for broad access even when no school is currently available. Use Next page to reach older connections and First page to return to the newest.

You can still revoke a connection after losing Use Kai.

To repair an unavailable default, choose an already authorized, currently eligible school and click Change default school. Adding schools or expanding access requires a new consent request through the assistant; changing the default does not add school access.

Review connection activity

The Connection activity section on your External assistants page shows recent sign-in, approval, token refresh, and security events linked to your account. Use Next page to review older activity. Some rejected requests cannot be linked safely to an account and therefore do not appear in this personal history. Kanri never displays access tokens, authorization codes, or callback query details here.

Stop one school’s access

Open Settings > Kai in that school. Turn off Enable external assistants (MCP) and save to stop access for everyone, or click Revoke school access on an individual connection.

This affects only your school. Other schools on the connection are unchanged. Revoking one school’s access also blocks that school for a connection covering all current and future schools. School managers cannot block an external client across all schools.

Review school access changes

School enablement changes, school-specific access revocations, and default-school changes are recorded in the school’s existing audit log. Staff with access to that log can review them under Logs > Events. See Reading the Audit Log.

These security entries do not start workflows. They do not expose access tokens or information from other schools. Platform-wide and personal connection events are not added to unrelated schools’ logs.

Kanri also keeps limited connection-request records for 90 days to investigate access and service problems. These record who connected, the school and read tool, timing and outcome, not chat content, search text, access tokens or returned member information. They are separate from the school’s ordinary Events page.

Revoking a connection does not delete copies already held by an assistant provider. Use that provider’s deletion controls or privacy-request process for those copies. External assistant reads do not create a Kai chat or incur Kanri model-inference charges; the external provider may charge for its own service.

Request limits

Access allows 120 requests per minute for your staff account, 60 per connection, and 300 authorized read-tool calls per school shared across connections. Authenticated requests that reach the limiter count even if they later fail; failed sign-in or authorization attempts do not use this request quota. If your assistant reaches a limit, it must wait for the retry interval instead of repeatedly trying again. Brief service-busy errors can also occur when too many requests run at once.

If a data request times out, ask for a smaller date range or more specific filters before retrying. Requesting fewer displayed rows alone may not reduce the work needed to calculate a total. A help-search service error is separate from school-data access; retry help search later rather than assuming a guide or feature does not exist.

Newly eligible schools can appear when broad access is selected. For an existing comparison, ask the assistant to keep the exact schools you selected rather than adding new ones silently.