Use Claude or ChatGPT on your law firm CRM safely with MCP
Connect an AI assistant to LeadLex through MCP, set the guardrails that exist today, and review what it can reach before the whole firm uses it.
Last updated
Connect the assistant to the LeadLex MCP server at https://mcp.leadlex.com/mcp, sign in with your own LeadLex login, and leave Allow AI assistants to send outbound switched off. The assistant sees what you see. It acts with your access and can create and change records, so brief it as you would a new colleague.
LeadLex has no read-only role, so the guardrails below are about your own habits and the settings that exist.
Steps
1. Decide the rule first
Write one sentence: what the assistant may do for you. For example "it reads, summarises and drafts, and I make the changes". The assistant can create and update records, so a rule on paper matters.
2. Connect the assistant
Follow the steps for your client in Connect Claude or ChatGPT to LeadLex. Use the server address exactly as shown, including /mcp. Sign in and choose Authorize.
3. Check the send setting
In Settings → API & Data, find Allow AI assistants to send outbound. A workspace admin controls it. It is off by default. It controls whether assistants can start campaigns. It does not stop an assistant from creating or changing other records, and it does not cover LinkedIn messages or connection requests sent from a connected LinkedIn account.
4. Start with questions, not changes
Begin with read-only requests: "What's in my pipeline?" and "Search my contacts for Sarah". Check the answers against the app. Only then ask for changes.
5. Keep secrets out of the conversation
Do not paste passwords, API keys or client confidential material into an assistant chat. If a script needs access, an admin creates an API key with the Read Only preset or the least it needs. That preset applies to API keys only, not to assistants.
6. Review connected assistants monthly
An admin opens Settings → API & Data, where Connected AI assistants lists each connection, when it connected, when it was last used and its permissions. Revoke what nobody uses. Revoking signs the assistant out immediately.
7. Know where data goes
Read Security, data location and GDPR and your firm's own policy on using AI with client data. What an assistant provider does with a conversation is governed by that provider's terms for your plan.
Lexi prompts
These work in your assistant once connected, and similar wording works in Lexi inside LeadLex.
What's in my pipeline? Show open deals by stage, with value and the next step for each.
Search my contacts for Sarah, and tell me when I last spoke to each one.
Prepare me for my next meeting. Use the company's deals, the last three emails and my notes.
Draft a follow-up email to Anna Mueller after yesterday's call. Do not send it.
Template to set up
| Item | Setting |
|---|---|
| Rule | One sentence on what assistants may do |
| Who connects | Each person with their own login |
| Outbound sending | Allow AI assistants to send outbound off |
| Start prompts | Questions only for the first week |
| Review | An admin checks Connected AI assistants monthly |
| Keys | One key per script, Read Only where possible |
How to measure it
- Connected assistants. The count in the list, against the people who should have one.
- Stale connections. Assistants not used for 30 days.
- Change audit. Spot-check a sample of records the assistant changed against what the person intended.
- Value. The time saved on a recurring task, such as meeting prep, measured on three examples.
FAQ
Is it safe to connect ChatGPT or Claude to a law firm CRM?
It is safe to the extent you control the access. The assistant signs in as you, sees only what you can see, and is scoped to your workspace. You decide the rule, keep campaign sending off, and review connections. Check your firm's AI and client confidentiality policy first.
Can I give an assistant read-only access?
Not today. There is no read-only role. API keys can be read-only, and the MCP connection acts with your permissions.
What does the send setting do?
It controls whether assistants can start campaigns. By default they can draft campaigns and add contacts but not start them.
How do I cut off an assistant?
A workspace admin revokes it in Connected AI assistants under Settings → API & Data. It is signed out immediately.
Something here does not match what you see in LeadLex? Write to lexi@leadlex.com and we will correct it.
