On this page
- 1What is an MCP server?
- 2How an MCP server works: hosts, clients, and servers
- 3Six MCP server examples for business systems
- 4Do you need an MCP server or a regular API integration?
- 5MCP server security best practices
- 6What does it cost to build an MCP server?
- 7How we approach an MCP server build
- 8Where to start
If your team uses Claude, ChatGPT, Copilot, or an AI coding tool, someone has probably asked whether the company needs an MCP server. So what is an MCP server, in business terms? It is a small piece of software that lets an AI assistant read from and act on one of your systems, such as a CRM, a ticket queue, or a reporting database, through a standard interface that many AI tools now understand.
This article is for leaders who heard the term in a vendor demo or a planning meeting and want a straight answer. We explain what an MCP server does, show where it pays off, cover the security questions your IT team will raise, and give planning estimates for a build. If you already know you want one, our page on MCP servers for business systems explains how we deliver them.
What is an MCP server?
MCP stands for Model Context Protocol. Anthropic introduced it in November 2024 as an open standard for connecting AI applications to tools and data. Before MCP, each AI product had its own plugin format, so connecting one internal system to three AI tools meant three separate integrations. MCP gives those tools one shared way to talk to outside systems.
An MCP server is the piece that sits in front of your system and speaks that protocol. It tells the AI what it can do ('search open tickets', 'look up a customer by email', 'create a draft purchase order'), what information it can read, and what inputs each action needs. The AI decides when to call it, the server does the work against your real system, and the result goes back to the AI as context for its answer.
That split matters for ownership. Your AI vendor owns the model and the chat window. You own the server, which means you decide what the AI can see, what it can change, and who gets to use it.
Key takeaway
An MCP server does not make an AI smarter. It gives the AI controlled access to your data and actions, and the quality of that control decides whether the result is useful or risky.
How an MCP server works: hosts, clients, and servers
Three roles show up in every MCP setup. The host is the AI application a person uses, such as Claude Desktop, Claude Code, or an IDE like VS Code or Cursor. Inside the host, an MCP client manages the connection to each server. The server exposes your system's capabilities to that client.
An MCP server can offer three kinds of things:
- 1
Tools
Actions the AI can call, like running a query, creating a ticket, or moving a deal to a new stage. Each tool has a name, a description, and a defined set of inputs.
- 2
Resources
Data the AI can read, such as a policy document, a product catalog, or a single record from your ERP.
- 3
Prompts
Reusable templates a user can pick from a menu, for example 'summarize this account before a renewal call'.
Servers connect in one of two ways. A local server runs on the user's own machine and talks to the host over stdio, which suits developer tools and personal workflows. A remote server runs on your infrastructure or in the cloud and uses Streamable HTTP, so a whole team can share it. Remote servers handle sign-in through OAuth-based authorization, which means each person logs in with their own account and the server acts with that person's permissions instead of a shared admin key.
For most companies, the remote server is the one that matters. It is the version you can put behind your identity provider, monitor, patch, and update in one place.
Six MCP server examples for business systems
The strongest MCP server examples we see in planning sessions share a pattern: a system people already query all day, a question that takes too many clicks to answer, and a small set of actions that are safe to automate. Here are six that fit most mid-sized companies.
- 1
CRM
A sales rep asks which of their accounts have a renewal in the next 60 days and no logged activity this month. The server runs that search in Salesforce, HubSpot, or a custom CRM, and can log a call note or create a follow-up task.
- 2
ERP and inventory
Purchasing staff check stock levels, open purchase orders, and vendor lead times in a single question. Write actions, such as drafting a purchase order, stay as drafts until a buyer approves them inside the ERP.
- 3
Internal documents and policies
The server searches SharePoint, Google Drive, or Confluence and returns the exact passages with links, so HR and operations answers come from the current handbook. For large document sets this pairs well with retrieval-augmented generation.
- 4
Ticketing and support
Agents pull up a customer's open tickets in Zendesk, Jira Service Management, or ServiceNow, get a summary of the history, and have the AI draft a reply or suggest a priority.
- 5
Read-only analytics
Managers ask questions in plain language and the server runs SQL against a read replica or reporting warehouse, using a database role that can only select from approved views.
- 6
Field operations and scheduling
Dispatchers ask which technicians are free tomorrow near a job site and what parts each truck carries, with answers drawn from the scheduling system and inventory together.
Most of these start read-only, and for good reason. Read access delivers value in the first week and carries far less risk. Write actions come later, one at a time, each with a clear approval step. When the systems involved are older or have no clean API, the MCP server is often the smaller part of the job, and most of the effort goes into the AI integration and automation layer underneath it.
Do you need an MCP server or a regular API integration?
Once a team knows what is an MCP server, the next question is whether a normal integration would do the job. MCP does not replace APIs. Most MCP servers call an API behind the scenes. The real question is who consumes the connection. A regular API integration links two pieces of software in a fixed way a developer designed. An MCP server lets an AI decide, in the middle of a conversation, which action to take and when.
| Situation | Better fit | Why |
|---|---|---|
| Nightly sync between your ERP and accounting system | Regular API integration | The steps never change, so there is nothing for an AI to decide |
| Staff want open-ended answers across CRM and support data | MCP server | The AI picks which tools to call based on the question |
| The same connector should work in Claude, an IDE, and your own agent | MCP server | One server works with any MCP-compatible host |
| A customer chatbot with three fixed actions | Either | Direct tool calls inside your app may be quicker to start |
| An internal AI agent that runs multi-step tasks | MCP server | Tools are reusable across agents and easier to govern in one place |
Key takeaway
If you can draw the whole workflow as a fixed flowchart, build a normal integration. If the useful version starts with a person asking a question in their own words, an MCP server is the better fit.
MCP server security best practices
An MCP server hands an AI model a set of keys to a business system, so security deserves more planning time than the tools themselves. These are the MCP server security best practices we apply on every build and look for when we review someone else's.
- Grant least privilege. Each tool gets the narrowest scope it needs. A reporting tool uses a read-only database role limited to approved views, and a CRM tool can add notes without being able to delete accounts.
- Act as the signed-in user. Per-user OAuth tokens mean the AI can only see what that person could already see in the source system. A single service account with access to everything is the most common mistake we find.
- Treat tool output as untrusted. A ticket, email, or web page returned by a tool can contain text written to steer the model, which is prompt injection. Returned content should be handled as data, and it should never trigger new actions on its own.
- Watch for tool poisoning. Models read tool descriptions, so a malicious or careless third-party server can hide instructions in them. Install servers only from sources you trust, pin versions, and review descriptions when they change.
- Handle tokens carefully. Keep secrets in a vault and out of prompts and logs, use short-lived access tokens, and never pass a token issued for your server through to some other service.
- Require human approval for write actions. Sending an email, changing a price, or issuing a refund should show the person exactly what will happen and wait for a click.
- Log every call. Record who asked, which tool ran, the inputs, and the result, and send those logs to the same place your security team already watches.
Some of these controls live in the server and some live in the policies around it. Our enterprise AI guardrails work covers approval flows, redaction, and monitoring across AI tools, and our article on secure enterprise AI integration goes deeper on identity, data residency, and vendor review.
What does it cost to build an MCP server?
The protocol is free and open, and official SDKs exist for common programming languages. Cost comes from the work around it: learning your system's data model, designing tools the AI uses correctly, wiring up authorization, and testing against real questions. We priced these at $100-$175 an hour, the going rate for most US development agencies. They are planning estimates, not quotes.
| Scope | What it includes | Estimated hours | Estimated cost |
|---|---|---|---|
| Read-only server for one system | 5-10 read tools, local or internal deployment, basic logging | 80-200 | $8,000-$35,000 |
| Team server with write actions | Remote server, OAuth sign-in, 10-25 tools, approval steps, audit logs | 200-450 | $20,000-$79,000 |
| Multi-system company server | Several systems behind one gateway, role-based tool access, monitoring, security review | 450-900 | $45,000-$158,000 |
Costs climb with older systems that lack a usable API, strict compliance requirements, and the number of user roles that need different permissions. Hosting a remote server is usually modest next to the build. Model usage is billed separately by your AI provider, per token or per seat depending on the product, so check their current pricing page before you budget. For what the middle tier looks like in practice, see how we scope and deliver MCP servers.
Key takeaway
Start with a read-only server for the one system your team queries most. It is the cheapest version, and it tells you within weeks whether people will use it.
How we approach an MCP server build
We start by sitting with the people who will use it and collecting the twenty or thirty questions they ask most often. Those questions decide which tools exist. A server with eight well-named tools that match real work beats one that wraps every endpoint of an API, because the model chooses tools from their names and descriptions, and a long list of similar tools leads to wrong calls.
Next we design each tool's inputs and outputs, mark which ones are read-only, and agree on an approval rule for every write action before any code is written. We test with real questions against a staging copy of your data and note every place the AI picks the wrong tool or misreads a result. Those notes drive changes to tool descriptions and output formats, and they become a test set we rerun after each change.
Deployment depends on who will use it. A developer tool can run locally. A team server runs in your cloud account behind your identity provider, with logs flowing into your existing monitoring. You own the code and the deployment. Scope options, hosting choices, and support terms are on our MCP server solution page.
Where to start
Pick one system and one group of users. Write down the questions they ask that system every week and the single action that would save them the most time. That short list is enough for us to scope a first server. Bring it to a free consultation and we will walk through it with you, then send back a fixed price and timeline for that exact scope so you can decide with real numbers in hand.