Your agents, plugged in
An MCP server is built in. Claude (OpenAI and the rest soon) reads, searches and writes contacts and deals through the same scoped API your team uses, with an API key your owner can revoke.
qCRM-v0.1.4
The CRM your agents can use.
Contacts, companies, deals and activities for a real place of business. MCP in, a Rust engine for the heavy lifting, sync across the office, signed webhooks out, and every row yours to export or delete. Light on the bill, warm on the eyes.
What the usual suspects charge extra for, or can't do.
qCRM runs on Cloudflare Workers and D1 with a SQLite twin for the desktop. One Worker, one database, one price that stays small.
A Rust engine, in your browser
Dedupe, forecasts and stale-deal sweeps run in a Rust wasm engine on your machine. Your rows never leave to be analysed, and it stays fast at 100,000 contacts.
A desktop app, for free
The same app ships as a desktop build with its own SQLite: works offline, syncs when it's back, and the data dir is yours.
Office sync
Every write lands in a change log with a sequence number. Any client, desktop or script asks since=N and gets exactly what changed. Conflicts come back named, not lost.
Signed webhooks
Every event posts to your URLs with an HMAC signature, retried with backoff for a day, and each delivery is on record with its status code.
Hashed orgs, real roles
An org's id is a hash of its owner's account and the server secret, so URLs carry nothing a stranger can walk back to a person. Seasonal, employee, manager, owner, admin and a super admin: who can delete, invite or export is one table you can read.
Export and delete, for real
One request gives an owner every row of their org as JSON. One request deletes an account, its orgs and all their rows. Privacy isn't a page here; it's two routes.
Private AI, opt-in
Analysis runs locally. When you choose, the engine can hand summaries to a model you run yourself. Nothing leaves without a click.
Calls and recordings (soon)
Clave, QNTBR's call tool with Whisper transcripts processed mostly on the client, will ship the way the engine does: sealed, and opened by a lease from artstewengine.
Two lines and Claude is in your CRM.
An owner makes an API key under Settings. The MCP server lists one tool per API operation, and the risky ones (deletes, members, exports) say so, so a careful agent asks first.
claude mcp add --transport http qcrm https://qcrm.qntbr.com/api/mcp \ --header "Authorization: Bearer qk_…"
Built so the easy thing is the safe thing.
Every query is scoped
No row is read without its org id in the WHERE. A contact in another org is a 404, not a 403, so ids don't leak what exists.
Sessions by Better Auth
Email and password, with GitHub and Google when the keys are set. Cookie writes check the origin, so a stranger's page can't post as you.
An audit log that stays
Members, roles, webhooks and keys are logged with who and when. Managers read it; nobody edits it.
Secrets never on disk
Deploy secrets resolve through 1Password at deploy time. The repo carries names, never values.