---
name: iblai-connect-ironclad
description: "Read and write Ironclad data through the Ironclad Public API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Ironclad data, or to set up an Ironclad MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Ironclad connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/ironclad — not part of the iblai/vibe repository. Checked against Ironclad's documentation on October 20, 2026; test it against your own Ironclad setup before you rely on it.

Ironclad is contract lifecycle management software. Workflows run contracts through drafting, approval and signature; completed contracts become records in the repository with metadata, attachments, entities and obligations.

## Auth & conventions

- **API:** Ironclad Public API (REST). REST endpoints under /public/api/v1 for workflows (launch, approvals, comments, signatures), records (CRUD, attachments, schema), entities, obligations, webhooks and data exports, plus a SCIM API for users and groups.
- **Base URL:** https://ironcladapp.com/public/api/v1/ (check your account's domain; sandbox instances differ)
- **Access:** Issued by your administrator. An Ironclad customer registers an OAuth client application in Ironclad. The /exports endpoint needs the Security & Data Pro add-on, bought through the Ironclad account team.
- **Auth:** OAuth 2.0 authorization code; OAuth 2.0 client credentials; Legacy bearer access token. OAuth 2.0 bearer tokens with per-endpoint scopes, e.g. public.records.readRecords, public.workflows.createWorkflows. Legacy access tokens still work, with a published migration guide to OAuth 2.0.
- **Limits:** Per-company buckets in requests per minute, e.g. workflows read 400, workflows write 40, records read 600, records write 200, MCP 80; company-wide cap 4,500 RPM. 429 includes Retry-After; X-RateLimit-* headers returned.
- Keep Ironclad credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Records** — List all records with filters, retrieve a record and its attachments, retrieve the records schema.
- **Workflows** — List or retrieve workflows, workflow schemas, approvals, turn history and sign-step status.
- **Entities** — List and retrieve counterparty entities and relationships.
- **Obligations** — Contract obligations and recurring instances.
- **Data exports** — Create and download exports (Security & Data Pro add-on only).

## Writes

- **Workflows** — Launch a workflow synchronously or asynchronously, update approval status, add comments.
- **Signature requests** — Send or cancel signature requests, remind or update signers. **Confirm with the user first.**
- **Records** — Create a record or replace a record's metadata.
- **Records (delete)** — Delete an existing record (scope public.records.deleteRecords). **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Ironclad publishes an official MCP server, Ironclad MCP server (https://ironcladapp.com/resources/articles/mcp-integrations). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - Ironclad supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "Do we have a signed NDA with Acme Corp?"
- "Show MSAs signed in the last six months that cap liability"
- "Where is the Johnson deal stuck in approvals?"
- "Launch an NDA workflow for Beta Inc. with jane@beta.com as signer"

## Guardrails

- Contracts, negotiation history and approval comments are confidential business and client information and may be privileged when prepared with counsel.
- Request the narrowest Ironclad scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- Ironclad Developer Hub: https://developer.ironcladapp.com/
- Ironclad API authentication: https://developer.ironcladapp.com/reference/authentication-api
- Ironclad API rate limits: https://developer.ironcladapp.com/reference/clm-api-rate-limits
- Ironclad MCP server: https://ironcladapp.com/resources/articles/mcp-integrations
- This connector on ibl.ai: https://ibl.ai/developer/connectors/ironclad
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections