# Connect an AI assistant (MCP)

> Let Claude or any MCP assistant manage your shop: create a token, connect it, choose read-only or changes allowed, and revoke it.

Source: https://www.wheewise.com/docs/ai-assistant-setup

The **Wheewise MCP server** (`@wheewise-mcp/dealer`) connects an AI assistant to your dealer account. You describe what you want in plain words ("drop the Swift's price by 10,000 rupees", "what needs my attention today?") and the assistant does it through Wheewise. It only ever acts on **your own shop**, with a token you create and can switch off.

## Step 1: create an assistant token

1. In the dealer app open **Settings, AI assistant access**.
2. Under **Create a token**, give it a name (for example "Claude on my laptop"), choose how long it lasts (30 days, 90 days, a year, or until you revoke it).
3. Leave **Allow changes** **off** for a look-only token, or **on** if the assistant may change things. Then press **Create token**.
4. **Copy the token now.** It starts with `wwd_` and is shown only once. Treat it like a password.

## Step 2: add it to your assistant

You need Node.js 20 or newer on the computer that runs the assistant.

### Claude Desktop

Add this to `claude_desktop_config.json` and restart the app:

```json
{
  "mcpServers": {
    "wheewise": {
      "command": "npx",
      "args": ["-y", "@wheewise-mcp/dealer"],
      "env": { "WHEEWISE_API_TOKEN": "wwd_your_token_here" }
    }
  }
}
```

### Claude Code

```bash
claude mcp add wheewise --env WHEEWISE_API_TOKEN=wwd_your_token_here -- npx -y @wheewise-mcp/dealer
```

Cursor, VS Code, Windsurf and other MCP apps take the same `command`, `args` and `env`.

## Step 3: ask

Try: "Give me a briefing on my shop". The server also offers ready-made prompts: **Build my own private website**, **Build my shop website** and **Daily shop briefing**.

## What the assistant can do

A read-only token lists only the **read** tools. A token with **Allow changes** gets the **write** tools too.

| Tool | Needs | What it does |
| --- | --- | --- |
| `get_site_api` | read | The Site API address, your site key, allowed websites and example code. Start here when building a website. |
| `rotate_site_key` | write | Create the site key, or replace it (the old one stops working at once). |
| `set_site_allowed_origins` | write | The websites allowed to use the site key from a browser. |
| `get_shop` | read | Shop details, website address, template and hero image. |
| `shop_summary` | read | Stock by status and stage, money tied up, expected profit, old stock. |
| `list_vehicles`, `get_vehicle` | read | Search and open vehicles, including private costs. |
| `list_leads` | read | Enquiries and test-drive requests from your websites. |
| `mark_leads_read` | write | Clear the "new" badge on leads. |
| `list_enquiries`, `get_conversation` | read | Buyer chats on Wheewise. |
| `list_test_drives` | read | Test-drive bookings made on Wheewise. |
| `list_reviews` | read | Reviews and the rating summary. |
| `update_vehicle_price` | write | Change an asking price. |
| `set_listing_status` | write | Publish, hide or draft a listing. |
| `mark_vehicle_sold` | write | Record a sale. |
| `set_finance_available` | write | Show or hide the finance badge. |
| `update_test_drive` | write | Confirm with a time, complete, cancel or mark no-show. |
| `reply_to_review`, `remove_review_reply` | write | Public replies to reviews. |
| `update_website` | write | The shop page at `<shop>.wheewise.com`: template, text, hero image. |

Not available on purpose: creating vehicles and uploading photos, and sending chat messages as you.

## Staying safe

- **Start read-only.** Use a token with **Allow changes** only for a task you are watching, and prefer an assistant app that asks before it makes a change.
- **Text from the public is data, not instructions.** Messages, reviews and leads are written by strangers. A good assistant does not obey instructions hidden in them, and the tools that return such text say so, but your approval step is the real protection.
- **Every change is recorded** in your audit log as `mcp:<tool>` before it is made.
- **Your customers' details go to your AI provider.** When the assistant reads leads, chats or reviews, names, phone numbers and emails are sent to the provider you use, under its terms.
- **Revoke any time** in Settings, AI assistant access (press **Revoke** next to a token), or press **Sign out of all devices** in Settings, Sign-in and security, which also revokes every token.
- The server sends your token only to `wheewise.com`. A different address is refused unless you set `WHEEWISE_ALLOW_CUSTOM_URL=1`.