Beyond Finance › Practice 05 › MCP integration
MCP servers & AI agent integration

Make your system callable by AI agents.

Your customers still click. Increasingly, the agents working on their behalf want to call your system directly instead. The Model Context Protocol is the interface that connection has standardised on, and wrapping a system you already run is a contained piece of engineering — not a rebuild.

Why now

Software is acquiring a second kind of user.

A human reads a screen and infers what to do. An agent cannot. It needs an explicit contract: here are the actions available, here is what each one expects, here is what it returns.

Your competitor shipped a connector

Once one product in a category can be driven by an agent, the evaluation question changes from which has better features to which one my tools can actually operate.

Staff are the integration layer

Someone reads a value off one internal system and types it into another. That is a person doing an API's job, all day, with a typo rate.

An API is not enough on its own

You may already have a perfectly good REST API. An agent still needs to discover what exists, understand when each call is appropriate, and be constrained to what this particular user may touch.

Demos are easy; production is not

A single-tenant proof of concept takes days. Multi-tenant isolation, authentication, audit and predictable failure behaviour are where the actual work lives.

What you get

An MCP server your customers' agents can actually use.

Built on the official SDKs, wired to the system you already run, and deployed on infrastructure you control.

01

Tool design

  • A tool list derived from what agents should be able to do, not from a mechanical dump of your existing endpoints
  • Description text written and rewritten until the agent picks the right tool reliably — this is the single highest-leverage part of the work
  • Read-only and state-changing operations clearly separated, so destructive actions are never reached by accident
02

Implementation

  • Built on the official MCP SDKs rather than a hand-rolled protocol implementation that drifts out of spec
  • Each tool wired to your real API, with no shadow copy of your data to keep in sync
  • Input and output schemas that reject bad calls loudly, because an agent handed a silent empty result will confidently tell your customer the wrong thing
03

Authentication and scope

  • Per-user and per-tenant boundaries, so an agent acting for one customer cannot reach another customer's data
  • Permission scopes that mirror what that identity may already do in your product, rather than a second, looser set of rules
  • Audit logging of which identity invoked which tool with which arguments
04

Deployment and testing

  • HTTP or Streamable HTTP transport on your own infrastructure, so your data is not routed through a third party
  • Verified in the agent clients your users actually run, not only against a test harness
  • Documentation, example prompts and an authentication configuration guide your customers can follow unaided
How it runs

Scoped as a project, not an open-ended retainer.

Most engagements start as a proof of concept on one system, precisely so both sides can see whether the agent behaviour is good enough before committing to production scope.

STEP 01

Requirements

Which actions agents should be able to take, against which systems, and where the permission boundary has to sit.

STEP 02

Tool specification

The tool list, the description text and the input and output schemas, agreed in writing before implementation starts.

STEP 03

Build and secure

Implementation against your API, then authentication and tenant scoping — which is most of the distance between a demo and production.

STEP 04

Prove and hand over

Behaviour tuned against real clients until tool selection is stable, then deployed with documentation. Maintenance is optional and separately priced.

Common questions

What people ask before committing.

What is MCP, in one paragraph?

The Model Context Protocol is an open standard for exposing a system's capabilities to AI agents. Instead of every product inventing its own way to be driven by an agent, and every agent client writing bespoke code for every product, both sides implement one protocol. Your system publishes a set of tools; any compliant client can discover them, understand what each does, and call them.

Do I have to rebuild my API?

No. An MCP server sits in front of what you already have. It is a translation and permission layer, not a replacement. If your existing API can do the thing, the work is exposing it correctly rather than building it again.

How is this different from just publishing an OpenAPI spec?

An OpenAPI document describes endpoints for a developer who will read it once and write code. MCP describes capabilities for an agent that must decide, at run time and without a human, which capability is appropriate right now. The practical difference shows up in the description text: an endpoint summary written for a developer is usually too terse for an agent to choose correctly from.

Which clients will be able to connect?

Any client that implements the protocol. In practice that includes the major agent and coding clients in current use, and the list keeps growing — which is the point of implementing a standard rather than a bespoke integration per vendor.

How do you stop an agent reaching another customer's data?

The server authenticates the caller and resolves every request against that identity's existing permissions in your product, rather than trusting anything the agent asserts about who it is acting for. Tenant scoping is applied at the data access layer, not merely checked in the tool description — a description is guidance to a language model, never a security control.

Where does it run, and who can see the data?

On your infrastructure. Requests go from the agent client to your server and to your API. We do not insert a hosted middleman, and there is no arrangement under which your customers' data passes through us in normal operation.

The specification is still changing. Will this break?

It will need occasional attention, which is why maintenance is offered as a separate, optional item rather than pretended away. Building on the official SDKs absorbs most protocol churn; the changes that actually reach you tend to come from your own API evolving, not from the protocol.

Can we start small?

That is the recommended way in. One system, a handful of tools, real client testing — enough to see whether agents behave usefully against your domain before anyone commits to multi-tenant production scope. If the answer turns out to be no, that is a cheap thing to have learned.

Tell us what you want an agent to be able to do.

Two or three concrete actions and the system they run against is enough to scope a proof of concept. We reply to every serious enquiry within two working days.