How to give AI access to Sage 300 CRE or on-premise Vista without opening your firewall
By the Junction team · Published 24 October 2026 · 4 min read
The short answer
- Sage 300 CRE and many Vista installations run on your own server with no usable cloud API, so an assistant in the cloud cannot reach them directly.
- You can open an inbound port or VPN, copy the data to a cloud warehouse, or run a small agent inside your network that connects outward. The third needs no inbound firewall change.
- Whichever you choose: use a login that can only read, exclude payroll, limit people by job, and keep an audit trail.
Much of the construction industry still runs its books on software installed in an office or a server room. Sage 300 Construction and Real Estate (formerly Timberline) is typically read through a 32-bit ODBC driver on the machine it runs on. Many Vista installations sit on SQL Server inside the customer's own network. None of this is reachable from a cloud AI assistant, and rightly so.
Three ways to bridge the gap
| Approach | How it works | Main drawback |
|---|---|---|
| Open an inbound path | Expose the database or an API through the firewall or a VPN so a cloud service can connect in | Adds an entry point to your most sensitive server. Needs firewall changes, ongoing patching and careful allow-lists |
| Copy the data to the cloud | Load tables into a cloud warehouse on a schedule and point the assistant at that | A second copy of your financial data to secure, with its own lag and cost; a data project before the first answer |
| Run an outbound-only agent | A small program inside your network reads the data and connects out over HTTPS to the connector | You install and maintain a program on one server, so it needs the same care as any software there |
Why outbound-only is the usual answer
A program that dials out opens no listening port, so there is nothing for an outside attacker to connect to. You allow one outbound HTTPS destination and nothing inbound. IT teams understand this pattern because it is how many monitoring and backup tools already work.
The design details matter more than the direction of the connection:
- The cloud should never send SQL. The agent should receive a structured request (which kind of record, which filters) and build its own queries from a model you can inspect. Then the worst a compromised cloud can ask for is data the model already allows.
- The model should be signed. If the agent only runs a mapping whose signature verifies, nobody can quietly widen what it reads.
- Reads only. Give it a database login or ODBC user with read permission only.
- Copy or live? For fragile systems, the agent can copy the needed tables to a local file every 15 to 60 minutes and answer from the copy, so the live system is never queried during working hours. Every answer should say when the data was last copied.
A checklist for your IT team
- Identify the server that has the Sage ODBC driver (or the Vista SQL Server) and who owns it.
- Create a database user with read permission only, limited to the tables needed.
- Confirm the server can make outbound HTTPS connections to the connector's address, and nothing more.
- Decide whether the agent reads live or from a scheduled copy, and what refresh interval is acceptable.
- Exclude payroll and personal tables from the model, in addition to any restrictions in the database.
- Decide which people may ask about which jobs, and record it before anyone connects an AI tool.
- Test with three questions whose answers you already know, then switch on an audit log.
- Document how to turn the agent off, and test that it works.
For the general risks, work through the MCP security checklist. For the Claude side of the setup, see how to connect Claude to your construction accounting data.
Frequently asked questions
- Can Claude or ChatGPT read Sage 300 CRE?
- Not directly. Sage 300 CRE is usually reached through a 32-bit ODBC driver on the server it runs on, so a connector with an agent inside your network has to read it and pass answers to the assistant.
- Do I need to open a firewall port to connect an on-premise system to AI?
- Not if the connector uses an outbound-only agent. The agent opens an HTTPS connection from inside your network to the service, so you allow one outbound destination and no inbound traffic.
- Will an AI connector slow down my accounting software?
- It can if it queries the live system carelessly. Safer designs apply time and size limits to every query, or answer from a scheduled copy that is refreshed outside busy hours.
- How fresh is the data when it comes from a copy?
- As fresh as the last copy, typically 15 to 60 minutes. A good connector shows the time the data was last updated with every answer.
Keep reading
Ask Claude or ChatGPT about your own systems
Junction connects Claude and ChatGPT to construction accounting, project and property systems. Early access, set up with you.