Casepoint MCP Connector

Updated

Updated on Aug 19, 2026
Published on Jun 10, 2026

18 minute(s) read

The Casepoint MCP server gives AI assistants access to Casepoint eDiscovery, FOIA, and Legal Hold capabilities through the Model Context Protocol (MCP), an open standard for connecting AI tools to external data and services. Once connected, you can ask your AI assistant about your matters, holds, and requests in natural language, and it retrieves the information on your behalf — without leaving the assistant.

How the Connection Works

The Casepoint MCP connection follows a simple layered flow:

You ask questions in natural language.
The AI assistant interprets the request and calls the appropriate Casepoint capability.
The Casepoint MCP server validates the request, enforces the selected workspace and organizations, and routes the read request.
The Casepoint platform (eDiscovery, FOIA, and Legal Hold) returns the requested data.

The AI assistant never connects to the Casepoint platform directly — every request passes through the Casepoint MCP server, which enforces the session's selections and the read-only boundary. Because that boundary is read-only and the Casepoint UI remains the system of record, connecting the assistant introduces no chain-of-custody or data-integrity risk: the assistant can brief and report, but it cannot alter the record.

Limitations

The current release is read-only. The assistant can read and search data, but it cannot write, delete, or produce. The Casepoint UI remains the system of record for all changes.
One scope per session. Each connection is bound to a single selection per product: one eDiscovery workspace, one FOIA organization, and one Legal Hold organization. To work in a different scope, you reconnect and select again.
Availability is defined by the connector's tools. The assistant can access only the capabilities exposed through the MCP tools; not all Casepoint data or functionality is available. See Capabilities and Tools below for the current list.

Considerations

Review the following before you connect an AI assistant to Casepoint:

The assistant acts as you. Every request runs under your identity, using your default role for the selected workspace or organization. The assistant sees only what you are already permitted to see, and its activity is recorded under your account.
Your scope is fixed for the session. The workspace and organizations you choose at sign-in are bound to that connection. The assistant cannot be redirected to another scope by asking. To change scope, reconnect and select again.
Read-only means no integrity risk. Because the assistant can retrieve and summarize but never alter documents, productions, holds, or requests, connecting it introduces no chain-of-custody or data-integrity concern. Any change is made in the Casepoint UI, where it is logged and defensible.
Review your AI provider's data-use terms. Casepoint data you send to the assistant is handled under your agreement with that provider. Review those terms before sending sensitive data.

Availability

The Casepoint MCP Server is available through the AI assistants listed below. The MCP Connector is available for our Casepoint (CE) clients. A Casepoint Gov connector for our government customers is coming soon.

AI assistant	Availability	How to connect
Anthropic Claude	Available	Add the Casepoint connector from the Claude directory (see Setup)
OpenAI ChatGPT	Available	Add the Casepoint connector from the ChatGPT directory (see Setup)
Microsoft Copilot	Beta — available on request	For a Casepoint MCP-enabled Microsoft Copilot agent, contact the Casepoint Product Support team, who will coordinate setup.
Google Gemini	Coming soon	—

Setup

Prerequisites

Before you begin, make sure you have the following:

An account with access to the relevant eDiscovery workspace, FOIA organization, or Legal Hold organization.
Supported AI assistant — Anthropic Claude, OpenAI ChatGPT.
Your Casepoint URL.

Authentication and Tokens

The connection uses OAuth 2.0 Authorization Code with PKCE. After you sign in and approve access, Casepoint issues the assistant a short-lived access token and a longer-lived refresh token:

The access token is valid for approximately 1 hour.
The refresh token is valid unless it is idle for 60 days. The assistant uses it to obtain new access tokens automatically, so you do not have to sign in every hour.

When the refresh token expires after 60 days of idle time, you must reconnect the assistant to Casepoint by repeating the setup steps. Signing out of the Casepoint UI does not revoke these tokens — to revoke access, follow the steps under Disconnecting / Revoking Access.

Setting up with Anthropic Claude

These steps connect Claude (the web app at claude.ai or the Claude desktop app) to Casepoint. The exact menu names vary by assistant, but the flow is the same.

Open Claude and sign in.

Go to Customize.

Go to Connectors.
Select Browse.

Search for Casepoint. Select the connector.

Select Connect.

Click Continue. Claude opens a Casepoint sign-in window in your browser.
On the Sign in screen — shown in the context of Continue to Claude — sign in with your Casepoint account. A note explains that you are authorizing Claude through the MCP connector. If you already have an active Casepoint session, this step is skipped.

On the Select access for Claude screen, choose the data you want this session to access. You can select at most one item from each category:
- One eDiscovery workspace
- One FOIA organization
- One Legal Hold organization

You must select at least one category to proceed. The selections you make here are bound to the connection for this session, and the session uses your default role for whatever you select. To change the scope later, you reconnect and select again.

When you are done, click Connect to consent.

On the Authorize access screen, review the read-only permissions you are granting — the selected workspace and organizations, and the read-only capabilities.

Access is governed by read-only scopes selected when you sign in. The confirmed scopes are eDiscovery.read, foia.read, and legalhold.read. The tools never write, delete, or produce regardless of scope and are revocable at any time.

Click Allow to approve (or Deny to stop). Claude completes the connection.

Confirm that the Casepoint connector is toggled on and available in Claude before starting to chat. The Casepoint capabilities are now available in your session.
To disconnect the Casepoint connector, select Manage Connectors.

Click Disconnect on the top right and confirm.

Setting up with OpenAI ChatGPT

These steps connect ChatGPT to the published Casepoint connector. The exact menu names vary by assistant, but the flow is the same.

Select Plugins from the left sidebar.

Search for Casepoint. Click the Add icon.

ChatGPT opens a Casepoint sign-in window in your browser; complete the Casepoint sign-in.

On the Select access for ChatGPT screen, choose the data you want this session to access. You can select at most one item from each category:
- One eDiscovery workspace
- One FOIA organization
- One Legal Hold organization
You must select for at least one category to proceed. The selections you make here are bound to the connection for this session, and the session uses your default role for whatever you select. To change scope later, you reconnect and select again.
When you are done, click Connect to consent.

On the Authorize access screen, review the read-only permissions you are granting — the selected workspace and organizations, and the read-only capabilities.
Access is governed by read-only scopes selected when you sign in. The confirmed scopes are eDiscovery.read, foia.read, and legalhold.read. The tools never write, delete, or produce regardless of scope and are revocable at any time.
Click Allow to approve (or Deny to stop). ChatGPT completes the connection.

The Casepoint connector is installed and ready for use.

To use Casepoint in a conversation, start a new chat, and use @Casepoint, or click + to add it.

To disconnect the Casepoint connector, select Plugins from the left sidebar. Select Casepoint. Select the ellipsis menu and select Uninstall.

Setting up with Microsoft Copilot

BETA

For access to a Casepoint MCP enabled Microsoft Copilot Agent, please reach out to Casepoint Product Support team, who can coordinate support for setting this up.

Setting up with Google Gemini

Coming soon!

Capabilities and Tools

Once connected, the assistant can use the following read-only tools, grouped by product. Each tool retrieves a specific kind of information and returns it to your assistant to summarize. An AI assistant can also chain several of the tools above to complete a task that spans multiple tools in a single request. All tools are read-only — they retrieve and summarize information and never write, delete, or produce. The Casepoint UI remains the system of record for any change.

The example prompts below are illustrative; phrase your own requests in whatever way feels natural.

eDiscovery

Typical roles: Review Manager, Attorney / Counsel, Production Manager, Litigation Support Specialist.

Capability Name	Capability Description	Tools	Example Prompts
Review Batch and QC Status Snapshot	Get a current snapshot of review progress for a matter — batch completion and document allocation counts — in one structured response ready for a stand-up, without opening Casepoint.	get_review_batch_qc_status	"How is review going on this matter? Give me a progress update for my morning stand-up."
Reviewer Productivity Summary	See how the review team is performing — per-reviewer documents reviewed, edits, time, and rate — in one response, without pulling a productivity report manually.	get_review_team_productivity	"How productive is the review team? Give me a reviewer-wise summary."
Processing and Exceptions Report	Get a processing exceptions report for a matter — what couldn't be processed and why, grouped by category — to assess data completeness and defensibility, without opening Casepoint.	get_processing_and_exceptions_report	"What data was processed, and was any of it unable to be processed? Share a summary of the processing exceptions."
Custodian Document Coverage	See what was collected per custodian — document volume, date range, and sources — to confirm coverage and surface attribution gaps, without opening the platform.	get_custodian_collection_summary	"What did the system collect per custodian? Share the custodian-wise document coverage summary."
Production Summary	See the production status for a matter — completed production sets with dates, document counts, formats, and Bates ranges — to verify productions before filing, without opening the platform.	get_production_qc_and_exports	"What has been produced on this matter so far? Give me the production sets with formats and dates."
Bates Range Verification	Reads the Bates ranges across all production sets so you can confirm there are no gaps.	get_production_qc_and_exports	"Pull the Bates ranges for all production sets on this matter — I need to confirm there are no gaps before our filing."
Matter Briefing	Get a consolidated overview of a matter in one response — custodians, review progress, production summary, and matter status — without logging in or navigating across screens.	get_workspace_summary	"Give me a quick overview of this matter before my 2 PM call: custodians, document counts, and current status."
New Matter Onboarding	Returns the basic orientation for a newly assigned matter: matter type, status, and custodians.	get_workspace_summary	"I've just been assigned to this matter. Who are the custodians, and what type of matter is this?"

Legal Hold

Typical roles: General Counsel / Legal Ops, Compliance Officer, Counsel.

Capability Name	Capability Description	Tools	Example Prompts
Legal Hold Portfolio	Get a complete, current inventory of all active legal holds across the organization — matter, custodian count, status, dates, and administrator — in one structured response, without opening Casepoint.	get_legalhold_list	"Show me every active legal hold across the org, grouped by matter, with custodian counts and hold status."
Legal Hold Details	Get a full briefing on a single hold — scope, administrators, start/end dates, and reminder schedule — in one response, without opening the Legal Hold module.	get_legalhold_details	"Walk me through the Acme hold: scope, admins, start and end dates, custodian count, and response status."
Custodian Roster Review	See the custodian roster for a specific hold — each custodian with their current status — to review who is on a hold and where they stand, without opening the platform.	get_legalhold_custodians	"List all custodians on the Acme hold with their employee ID, department, hold status, and acknowledgment date."
Organization-wide Directory	See the organization-wide custodian directory, i.e., every person or contact tracked in the organization's directory, not the roster of any one hold.	get_people	"Pull the full contact/custodian list for the organization."
Preservation and Collection Details	See what data is being preserved and collected under one named legal hold, including preservation status, collection status, dates, locations, and collection size.	get_legalhold_preservation_collections	"Show me the preservation and collection status for Acme hold."

FOIA

Typical roles: FOIA Officer, FOIA Supervisor, FOIA Compliance Director, Records Officer.

Capability Name	Capability Description	Tools	Example Prompts
FOIA Upcoming Deadline Triage	See which FOIA requests are coming due — filtered by component, assignee, and processing track — to triage the day's deadlines, without opening the platform.	search_requests	"Show me all FOIA requests due in the next 7 days by component, with assignee and processing track."
Overdue FOIA Request Escalation	See which FOIA requests are overdue across a component — sorted by most overdue — to drive escalation, without manually filtering each queue.	search_requests	"Show me all overdue FOIA requests in the Northeast component, sorted by most overdue first."
FOIA Agency-Wide Compliance Risk	Get a consolidated, agency-wide view of FOIA compliance risk across all components — overdue and at-risk requests, broken down by component and processing track — in one response ready for a leadership briefing.	search_requests	"Show me all FOIA cases at risk of breaching their deadline this week across all components."
FOIA Live Requester Lookup	Pull up a requester's open FOIA requests and full details on any one of them — instantly, mid-call — without putting the requester on hold to search the platform.	search_requests, get_request_detail	"A requester is on the phone. Pull up her open requests and give me the full details on her oldest case."
FOIA Annual Report Data	Generate statutory FOIA annual-report figures for a fiscal year — requests received, closed by track, processing days, fee waivers — in one response, without manually assembling the numbers.	get_annual_report	"Pull the FY2026 numbers for the annual report: total requests received and closed, counts by track, fee waivers granted, and average processing days."

A Worked Example: Review Status for a Stand-up

The following is an illustration of what a response looks like. The numbers are sample data, not real metrics.

You ask: "How is review going on this matter? Give me a quick status for my morning stand-up."
Your AI assistant replies (after reading the review status, read-only):
"Here's the review status for this matter:
Documents: 611 total · 175 reviewed · 0 produced
Review progress: 28%
Phases: 5
Batches: 31 total · 7 active · 2 completed · 22 pending
Reviewers active: 3
Custodians on workspace: 14
Opened: May 23, 2026
The remaining batches are largely concentrated in the pending group. Let me know if you'd like a reviewer-by-reviewer breakdown."

The assistant produced this by reading the matter's review status; it did not change anything. For any action that writes, deletes, or produces, use the Casepoint UI directly.

How Prompts Translate to Tool Calls

When you ask a question, the AI assistant interprets your request, selects the matching Casepoint tool, and calls it against the workspace or organization you selected during setup. The assistant chooses tools based on the tool names and descriptions Casepoint provides, together with your prompt; it then reads the result and summarizes it in natural language. Because the connection is read-only, the assistant retrieves and reports information but never changes it. For any action that writes, deletes, or produces, use the Casepoint UI directly.

Staying within your Selected Scope

Your AI assistant can only access the workspace or organization you selected when you signed in. That scope is fixed for the session. If you ask the assistant about a different workspace or organization, it will not switch on its own — instead, it will tell you to reconnect and select the one you want. The assistant cannot be redirected to another workspace simply by asking. For example, you may see a response like this:

"I'm currently scoped to [your selected matter] for this session. To access a different workspace, reconnect Casepoint in your assistant 's settings and select it there. Access is bound to the selections you made when you signed in."

This is the security boundary that keeps each session confined to the scope you authorized.

Disconnecting / Revoking Access

Each AI assistant connection you have authorized appears as its own session. You can revoke one connection while your other authorized connections stay active.

To revoke an AI assistant’s access to Casepoint:

Log in to your Casepoint account and click your Username at the top-right corner to view your profile.
Locate Connected Apps and click Manage.

The page lists your active sessions — each authorized AI assistant appears as a separate session (for example, Claude and ChatGPT appear as separate sessions).

Find the session you want to revoke.
Click Revoke for that session. Other sessions are unaffected and stay active.

The effect is near-immediate: the next request from that connection is denied. After you revoke a connection, reconnecting it requires signing in again, re-selecting the workspace or organization on the Select access for <AI assistant> screen, and reviewing consent on the Authorize access screen.

Security & Compliance

The Casepoint MCP Server extends the same security standards that govern the Casepoint platform to AI-assisted workflows. Access is restricted to authenticated users with valid Casepoint credentials — there is no anonymous or unauthenticated access.

Authentication

The connection uses OAuth 2.0 with OpenID Connect (Authorization Code flow), and PKCE (RFC 7636) is required for the AI assistant client. You authenticate directly against Casepoint's identity provider; the AI assistant never receives, transmits, or stores your Casepoint password. Access tokens are short-lived and refreshed automatically; expired or invalid tokens are rejected. Redirect URIs are strictly allow-listed, and requests with unregistered redirect URIs are rejected.

Scoped, Permission-enforced Access

Your access token is bound to the specific eDiscovery workspace, Legal Hold organization, or FOIA account you select at sign-in — no scope can be supplied as a tool parameter. Within that scope, every tool call is evaluated against your organization, workspace, and role-level permissions (including document-level restrictions), exactly as in the Casepoint application. The AI assistant can retrieve only the matters, documents, holds, and reports you are already entitled to view. The MCP layer grants no additional access.

Read-only by Design

All tools in the current release are declared read-only (readOnlyHint: true). The server exposes no create, update, or delete operations, which structurally eliminates entire classes of risk, including data tampering and destructive prompt-injection outcomes. The Casepoint UI remains the system of record for any change.

Data Protection

All traffic between the AI assistant and the MCP Server is encrypted with TLS 1.2 or higher. Customer data within the platform is encrypted at rest under Casepoint's FedRAMP-authorized controls. The MCP Server is a stateless integration layer — it does not persist, cache, or replicate customer content outside the Casepoint platform; responses are generated on demand from the authoritative data store. Casepoint does not use data transiting the MCP Server for model training, analytics, or any secondary purpose.

Network Security

All inbound traffic is inspected by an enterprise Web Application Firewall (Imperva) providing OWASP Top 10 protection, bot mitigation, and DDoS defense. Tool parameters are validated server-side and executed through parameterized data-access layers to prevent injection attacks, and API-level rate limiting protects platform availability.

Auditability

All MCP tool invocations are logged through Casepoint's centralized API instrumentation — including the tool invoked, the outcome, and a timestamp — and the authenticated user identity is captured and correlated with tool activity, the same as UI access. Logs are retained and monitored in line with the platform's compliance obligations.

Compliance Certifications

The Casepoint platform maintains an independently assessed compliance portfolio, and the MCP Server operates within this accredited boundary and inherits the corresponding controls:

Category	Certifications and Frameworks
U.S. Federal & Government	FedRAMP High; FedRAMP Moderate
Cybersecurity Standards	CMMC Level 2; ISO/IEC 27001:2022; SOC 1; SOC 2; SOC 3
Government & Control Frameworks	NIST SP 800-53; NIST SP 800-171; GovRAMP
Quality & Privacy	ISO 9001:2015; PIPEDA adherence and applicable regional data-residency mandates

Detailed attestation reports and authorization documentation are available on request under NDA.

Troubleshooting

The table below lists a few commonly faced errors and how to troubleshoot them.

Error	Troubleshooting Steps
Connection fails / Server error	Check your Casepoint credentials and re-consent on the Select access for <AI assistant> screen.
Token expired / Need to reconnect	The refresh token expires after 60 days of idle time. You must reconnect the AI assistant to Casepoint by repeating the setup steps.
No data returned	Confirm whether you have selected the correct workspace and/or organization.
Tool not available	Confirm whether the Casepoint connector is toggled on.

Frequently Asked Questions (FAQs)

How does the connection authenticate?

The connection uses OAuth 2.0 Authorization Code with PKCE. You sign in with your Casepoint account and approve the access on a consent page. The assistant receives a short-lived access token and a refresh token; it never sees your password.

Which AI assistants are supported?

We have MCP connectors being added to the MCP connector directories for OpenAI (ChatGPT) and Anthropic (Claude). We are also in process of establishing an MCP enabled Casepoint Agent in the Microsoft Copilot Studio. For further support setting up MCP connected solutions in these ecosystems, please reach out to Product Support.

Where does the MCP server run?

The MCP server runs as part of the Casepoint platform. The AI assistant connects to it over the connector URL; it does not connect to the Casepoint platform directly.

Can the assistant work in a different workspace if I ask it to?

No. The assistant is scoped to the workspace or organization you selected when you signed in, and that scope is fixed for the session. To work in a different workspace or organization, reconnect Casepoint in your assistant’s settings and select it there.

Which role does the assistant use?

The session uses your default role for the selected workspace or organization, and it acts under your identity. The assistant can see only what your default role allows.

Does it work on mobile?

Yes. As long as you can authenticate to Casepoint, you can use your AI assistant’s iOS or Android app to send prompts and read information through the MCP connector, provided your organization permits the assistant on mobile devices.

Can I choose which AI model is used?

Casepoint is model-agnostic and works the same across supported clients. You can choose from among various models available for your assistant as you typically do while querying.

Can the assistant change anything in Casepoint?

No. The connection is read-only. The assistant can read and search, but it cannot write, delete, or produce. The Casepoint UI remains the system of record, so there is no chain-of-custody or data-integrity risk from the connection.

Data Processing Agreement

For data processing details, review your Casepoint agreement and your agreement with Anthropic.

For privacy and cookie policy details, review your Casepoint agreement and your agreement with Anthropic.

Support

Please reach out to Casepoint Support in case of any queries or concerns.

Documentation Index