Connecting Claude to Clio with MCP: A Small Firm Guide

By Jude Lee · · Custom

Attorneys and a paralegal reviewing matter files and a laptop dashboard in a small law firm conference room

Every unimpressive AI demo a law firm has sat through has the same root cause: the model knows nothing about your firm. It can write a competent motion-in-limine template. It cannot tell you which of your open matters have a discovery deadline in the next 21 days, because it has never seen your practice management system.

MCP is the piece that closes that gap. It’s worth understanding even if you never build one, because it’s the deciding factor in whether “AI in law firms” means fancier autocomplete or an agent doing actual work.

What MCP actually is, without the marketing

The Model Context Protocol is an open standard, introduced by Anthropic in late 2024 and now supported across multiple AI vendors and tools, for connecting AI assistants to external data and actions. Practically: instead of every AI product building a bespoke integration with every software product, an application exposes an MCP server that describes what data and actions it offers, and any MCP-compatible client can connect under permissions you set.

Think of it as a standardized adapter. Your practice management system publishes a short menu — “you may search matters,” “you may read documents in this folder,” “you may propose a time entry” — and the assistant can only use what’s on the menu. It’s not a data dump; it’s a governed, auditable set of doors.

Two things follow, and they’re the whole point: the AI stops guessing about your practice because it’s reading real records, and it can take actions rather than only produce text. That’s the line between a chatbot and an agent.

Four places this fits a small firm’s actual week

Matter Q&A over your own files. “What’s the current settlement posture on Reyes, and what did opposing counsel say about the expert deadline?” The agent searches the matter, reads correspondence and notes, and answers with citations to specific documents. Read-only, so it’s the safest first build.

Drafting inside the matter context. A demand letter or status update drafted with the real parties, dates, and facts pulled from the system, then saved back to the right folder under your naming convention. A step beyond template-and-merge document automation — with a human approving before anything leaves the building.

Intake and conflicts as one flow. The agent extracts parties and adverse parties from a call summary, searches your client and matter list, flags near-matches — and only after a person clears the conflict does it open the matter shell. See automating conflict-of-interest checks.

Discovery triage. Point the agent at a production folder with a defined skill — a reusable, packaged set of instructions that teaches the assistant to do one job the same way every time — and have it classify by issue, flag privilege candidates, and log its reasoning. The skill is what makes output consistent across three associates and six months.

A prompt is a conversation. A skill is a procedure. Firms that get durable value from AI write procedures.
— Legal Ops Guide

What a Clio connection actually involves

Clio Manage exposes a public REST API. Access uses OAuth 2.0: you register an application in Clio’s developer portal, the firm authorizes it, and your server receives tokens rather than storing anyone’s password. Publishing an app for other firms goes through Clio’s review process; an internal application used only by your own firm follows a different path — confirm which applies to you in Clio’s current developer documentation before you scope anything.

Access is granted per resource — matters, contacts, documents, activities (time entries), calendar entries, bills — through OAuth scopes, and you request the narrowest set you need. Verify the exact scope names and whether read and write are separately grantable, since these change; as of 2026, treat any list in a blog post as stale.

What a custom MCP server over that API can expose is bounded by the API itself: matter metadata, contact records, notes, time entries, calendar dates, and documents actually stored in Clio. What it will not see: email sitting unfiled in Outlook, documents in NetDocuments or Dropbox, the text inside scanned PDFs unless you OCR them first, and anything your team keeps in a spreadsheet. It’s also subject to API rate limits, which shapes how you design search. Clio ships its own AI features too — check whether they already cover your use case before building.

Where the credentials live, and what leaves your building

OAuth tokens belong in your MCP server’s secret store — never in a prompt, a chat window, or a config file in a shared drive. The server, not the model, enforces scopes: the assistant can only invoke tools you’ve defined, with the permissions the token carries, so a jailbreak-style prompt cannot reach data the token can’t. Mirror your ethical walls in the server’s own filtering, not just in the vendor’s UI.

Matter content the agent retrieves does leave your tenancy when it’s sent to the model provider for inference. Check your AI client’s data retention and model-training terms — commercial and enterprise agreements typically differ from consumer ones — and confirm the arrangement satisfies your confidentiality obligations. Your audit log should record, at minimum: timestamp, authenticated user, tool called, parameters passed, record IDs touched, whether the call read or wrote, and who approved any write.

Scoping a first build without betting the firm

  1. Pick one question your team asks fifty times a month

    Not a category — a question. “Which matters have a filing deadline in the next 30 days and no draft on file?” is buildable. “Make us more efficient” is not.

  2. Start read-only

    Version one exposes search and read, and nothing that writes, sends, files, or bills. You’ll learn most of what you need about accuracy and trust before granting any write access.

  3. Scope permissions to match your ethical walls

    If a paralegal can’t see the screened matter, the agent acting on their behalf shouldn’t either.

  4. Test against known answers

    Take 25 questions you already know the answer to. Run them, count misses, and read how it missed — confident wrong answers are the failure mode that matters.

  5. Add write actions one at a time, behind human approval

    Draft-and-save before draft-and-send. Propose-a-time-entry before post-a-time-entry.

Where this genuinely breaks

Custom build vs. buying the feature

Most firms today run general-purpose assistants for drafting plus AI buttons embedded in tools they already pay for; a smaller group uses dedicated platforms like CoCounsel or Harvey. The ABA publishes its annual Legal Technology Survey Report if you want adoption figures — go to the primary source rather than a percentage quoted in a blog post, including this one.

Off-the-shelf legal AI
Fastest path to value. Vendor handles security review, updates, and model changes. Strong where the vendor has already productized your workflow. Weakness: you get their workflow, it only sees data inside that product, and per-seat pricing scales with headcount.
Custom MCP server + skills
Fits your actual procedure and spans systems vendors don’t connect. You own the skills and the audit trail. Weakness: real build and maintenance cost, you’re responsible for security review, and it needs an internal owner.

My rule of thumb, stated as opinion: buy first, build only where the bought thing demonstrably can’t reach. There’s a fuller framework in custom vs. off-the-shelf legal software and a reality check in what actually works vs. hype.

Putting a number on it without inventing one

Build your own case with numbers you can defend:

(hours per week on the target task) × 52 × (blended rate or fully-loaded cost of the person doing it) = the annual pool you’re competing against.

Then discount it hard. Recovered time only converts to revenue if it’s reallocated to billable or business-development work. Subtract build or license cost, the reviewer’s time, and an accuracy tax you can actually estimate: (share of outputs needing rework) × (minutes per rework) × (outputs per year). If one in five drafts needs ten minutes of fixing, that’s your tax — measure it during the read-only pilot rather than assuming it’s zero.

On rates: use your own realized rate, not the headline numbers circulating online. Automation doesn’t change your rate. It changes how many of your hours are billable-quality work versus file-shuffling, and that’s the honest case for it. Model the payback here.

Where is your firm losing billable hours?

Get a free automation audit: we map your intake-to-invoice workflow and show you exactly what's worth automating — before you spend a dollar.

Get a free automation audit

Related guides