AI & automation · Guide
What is an MCP server, and what is it for?
An MCP server is a program that exposes the data and actions of a system, such as an ERP, a CRM or a database, to AI agents through the Model Context Protocol (MCP), an open standard. Any compatible application can discover the server's tools and use them with the permissions you set, with no separate integration for each agent.
Master TimmUpdated on 6 min read
What the Model Context Protocol (MCP) is
MCP is an open protocol that standardizes how AI applications connect to external data and tools. Anthropic created it, and it is now maintained by the Agentic AI Foundation, part of the Linux Foundation. Claude, ChatGPT, Cursor, Gemini, Microsoft Copilot and VS Code are among the products that support it.
- Host: The AI application a person uses, such as an assistant, an IDE or the company's own agent.
- Client: The connector, inside the host, that talks to one MCP server.
- Server: The program that offers the data and actions of a system; it is the piece a company builds on top of its own ERP, CRM or API.
Messages follow JSON-RPC 2.0. A server can run as a local process, connected to the host through standard input and output (stdio), or as a remote service over HTTP (Streamable HTTP), the usual setup when many people and agents use the same system.
Tools, resources and prompts: what an MCP server exposes
The specification defines three primitives a server can offer. What sets them apart is who decides to use them: the model, the application or the person.
| Primitive | Who decides to use it | Example on an ERP |
|---|---|---|
| ToolsFunctions that run a lookup or an action | The model, during the task | Check an order status or open a ticket |
| ResourcesData and content that give context | The application, which attaches the content | The product catalog or the return policy |
| PromptsReady-made instruction templates | The person, who picks the template | A customer-summary command in the assistant |
Each tool has a name, a description and a JSON Schema for its parameters. The model picks a tool from that description, so clear names and precise descriptions matter as much as the code. A tool can also declare the shape of its result (outputSchema), which lets the client validate the result before handing it to the model.
MCP server, REST API or direct integration: when to use each
An MCP server does not replace the system's API. In most cases it is a thin layer on top of it, designed to be used by models. The question that decides is who will consume the integration.
| Approach | Who consumes it | When to use it |
|---|---|---|
| REST APIA contract between systems, called by code | Other systems and developers | Deterministic integrations, with no language model in between |
| Direct tool callingFunctions declared in one agent's code | A single agent or application | One agent with a few tools, maintained by the same team |
| MCP serverTools and data published through an open protocol | Many agents, IDEs and assistants | When the same system will serve more than one agent or AI product |
With MCP, business logic and access rules stay in the source system. The server translates the system into tools and limits what the model can do there.
Security: permissions, authentication and auditing
The specification treats every tool as code execution and recommends that a person can always deny a call. In practice, the security of an MCP server rests on a few controls, applied from the first version.
- Least privilege: Each tool does only what the task needs, and reads and writes live in separate tools with different scopes.
- Authentication: Remote servers use OAuth 2.1, as the specification defines; a token is valid only for that server and is never passed on to another system.
- Human approval: Sensitive actions, such as paying, deleting or sending data outside, ask for confirmation before they run.
- Validation: The server validates every input, rate-limits calls and sanitizes outputs, because a tool result can carry malicious instructions (prompt injection).
- Auditing: Every call is logged with who asked, the parameters used and what came back.
How to start an MCP server on top of your ERP or CRM
The safest path is to start small and read-only, then widen the scope as tests show that the agent uses the tools the right way.
- Pick the tasks: List the questions and actions the agents need, such as looking up orders or stock, and who on the business side validates the result.
- Start with reads: Publish lookup tools and resources first; actions that change data come later, with human approval.
- Design the tools: A few of them, with clear names, plain descriptions and parameters validated by JSON Schema.
- Protect access: OAuth 2.1 with scopes per tool on a remote server, or credentials from the environment on a local one.
- Test with real agents: A dataset of real and edge-case requests shows whether the model picks the right tool with the right parameters.
- Run it with traces: Log every call, its latency and its errors, and version the server together with the API it exposes.
Zorbit, Master Timm's own product for orchestrating AI coding agents, has an MCP plugin with about 74 tools. In a set that large, clear names and descriptions are what let the model pick the right tool.
Related service
AI & LLM Engineering
AI agents, RAG and MCP in production, not in demos.
Free first conversation · Reply within 1 business day
See also: AI Business Process Automation and AI Software Automation.
Frequently asked questions
Does MCP work with any AI model?
It works with any application that implements an MCP client, whatever model runs behind it. The protocol does not depend on Claude, GPT or Gemini: what matters is that the host supports MCP and the model can call tools (tool calling), which most current models do.
Can we expose read-only access, with no changes to the system?
Yes, and it is the recommended way to start. The server publishes only lookup tools and resources, uses a read-only credential on the source system and, when it runs remotely, OAuth scopes that do not allow writes. Actions that change data come later, one at a time, with human approval.
Is it safe to install third-party MCP servers?
Only after a review, because an MCP server runs code and feeds content to the model. The specification says to treat tool descriptions and annotations as untrusted unless they come from a trusted server. Check the source and the version, run the server with least privilege and review what each tool can reach.
Who maintains the MCP server after it goes live?
The team that maintains the system it exposes, because the server changes along with the API and the business rules. It is versioned next to the API, with automated tests, evals of the tools and usage traces. When Master Timm builds the server, the documentation and the handover to your team are part of the delivery.
Sources
Master Timm · Updated on