How to give AI access to Sage 300 CRE or on-premise Vista without opening your firewall
By the Junction team · Published 24 October 2026 · Updated 3 November 2026 · 3 min read
The short answer
- Sage 300 CRE and many Vista installations run on your own server, so an assistant in the cloud cannot reach them directly.
- You can open an inbound port or VPN, copy the data to a cloud warehouse, or run a small agent inside your network that connects outward. The third needs no inbound firewall change.
- Junction uses the third. Whichever you choose, limit people by job, keep an audit trail and know how to switch it off.
Much of the construction industry still runs its books on software installed in an office or a server room. Sage 300 Construction and Real Estate (formerly Timberline) and many Vista installations sit inside the customer's own network. None of this is reachable from a cloud AI assistant, and rightly so.
Three ways to bridge the gap
| Approach | How it works | Main drawback |
|---|---|---|
| Open an inbound path | Expose the system through the firewall or a VPN so a cloud service can connect in | Adds an entry point to your most sensitive server. Needs firewall changes, ongoing patching and careful allow-lists |
| Copy the data to the cloud | Load your data into a cloud warehouse on a schedule and point the assistant at that | A second copy of your financial data to secure, with its own lag and cost; a data project before the first answer |
| Run an outbound-only agent | A small program inside your network connects out over HTTPS to the connector | You install and maintain a program on one server, so it needs the same care as any software there |
Why outbound-only is the usual answer
A program that dials out opens no listening port, so there is nothing for an outside attacker to connect to. You allow one outbound HTTPS destination and nothing inbound. IT teams understand this pattern because it is how many monitoring and backup tools already work.
A checklist for your IT team
- Identify the server your accounting system runs on and who owns it.
- Confirm the server can make outbound HTTPS connections to the connector's address, and nothing more.
- Decide which people may ask about which jobs, and record it before anyone connects an AI tool.
- Test with three questions whose answers you already know, then switch on an audit log.
- Document how to turn the connection off, and test that it works.
For the general risks, work through the MCP security checklist. For the Claude side of the setup, see how to connect Claude to your construction accounting data.
Frequently asked questions
- Can Claude or ChatGPT read Sage 300 CRE?
- Yes, through Junction. Sage 300 CRE runs inside your network, and Junction connects it to Claude, ChatGPT, Gemini and Copilot without opening your firewall.
- Do I need to open a firewall port to connect an on-premise system to AI?
- Not with an outbound-only agent. It opens an HTTPS connection from inside your network to the service, so you allow one outbound destination and no inbound traffic.
- How long does it take to connect an on-premise system?
- Minutes for cloud systems and about an hour for on-premise ones. There is no onboarding project and no consultant. Help from our team is optional.
Keep reading
Ask your AI about your own systems
Junction connects the systems your teams run, from construction ERPs to ad platforms, to Claude, ChatGPT, Gemini and Copilot. Connect in minutes (about an hour for on-premise systems).