Published
7 MIN READ
MCP for business: what to require before connecting AI
MCP for business is the use of the Model Context Protocol, an open standard, to connect AI assistants to a company's internal systems, like CRM, ERP and databases. The protocol solves the connection, not the security. Whoever hires the work needs to demand proper authorization, minimum scope, auditing and a read-only start.
The conversation usually starts from the wrong end: someone saw a demo where the AI looks up orders and answers customers, and wants the same by tomorrow. At Wama, AI goes into code and automation, with Claude Code and Framer's agents, and every output gets a human read before it reaches the client. That rule, described in the article on Claude Code in development, matters even more when AI gets access to real data.
What is MCP and why should a company care?
MCP is a protocol that standardizes how an AI application discovers and calls external tools. Each system gets an MCP server that exposes actions (look up a customer, open a ticket, generate a report), and the assistant decides when to use each one. Before, every integration was built by hand, one per model and one per system.
For the company, the practical effect is that AI stops being a chat window and starts acting inside the operation. Large vendors already offer ready-made servers: Microsoft documents an MCP server for Microsoft Graph, on a page dated May 20, 2026, that gives agents access to Microsoft 365 data. This shift resembles what happened with Framer's AI agents for business: the tool becomes easy to connect, and the decision about what it can touch is still yours. Anyone who has looked into how AI reads a website, in the case of ChatGPT building business websites, will notice the leap: here it reads and writes in the system.
What risks has OWASP already mapped in MCP?
OWASP, the foundation that publishes the most widely used risk lists in software security, maintains an MCP Top 10, in beta on a page updated September 13, 2026. The list starts with poor token management and secret exposure (MCP01) and privilege escalation through scope that grows little by little (MCP02).
Next come tool poisoning, supply chain attacks, command injection and injection of instructions hidden in the content the model reads. The last three items matter to decision-makers: lack of auditing and telemetry (MCP08), MCP servers installed without approval (MCP09) and context shared beyond what it should be (MCP10).
The practical takeaway is simple. An MCP server is software holding credentials, taking orders from a model that can be fooled by any piece of text. That's why the care required resembles any protection layer on a website, like the Framer firewall: a barrier at the door helps, but it doesn't replace knowing who comes in and what they can do.
What the specification requires for authorization
The MCP authorization specification, version of November 25, 2025, is the technical yardstick for network-accessible servers. It follows OAuth 2.1 and includes requirements that buyers can demand in a contract, even without reading code.
Mandatory PKCE: the AI client must use this protection in the login flow, which prevents a stolen authorization code from turning into access.
Token with the right audience: the server must validate that the token was issued for it and reject any other.
No token passthrough: the server can't accept the user's token and pass it along untouched to another API.
HTTPS on every authorization endpoint, with no exception for production.
In a regulated company, this conversation adds to what is already required in fintech software development: a trail of who accessed what and role-based permissions. If the vendor can't explain how they meet these four points, the project is still a prototype.
Why start read-only?
Starting with read-only tools limits the possible damage while the team learns how the assistant behaves with real data. Microsoft's enterprise patterns guide for MCP recommends exactly this order: read-only servers first, a list of approved servers, the user's identity preserved end to end and human approval before any high-impact write.
The same guide makes a point that's worth gold for buyers: the gateway can't be the only control point. Permissions and scopes also need to be checked inside the MCP server and in the database itself, in layers.
Wama learned, using AI to build its own projects, that it speeds up building, not deciding; the overall timeline didn't change. The same happens with MCP: connecting the server is fast, while deciding which actions it exposes and who approves each write is the real work. Anyone thinking about building a SaaS with AI runs into the same question sooner or later.
Checklist to bring to your vendor
This checklist sums up what the specification, OWASP and Microsoft's guide ask for, turned into questions that fit in a proposal meeting.
Question for the vendor | The answer you want to hear |
|---|---|
Which tools does the server expose in the first phase? | A short, read-only list. |
Which identity does the AI use to access data? | The user's, never a master account. |
How is the token validated? | OAuth 2.1 with PKCE and audience checks. |
Where are the secrets kept? | In a vault, short-lived, outside the prompt. |
What gets logged? | Every call, with user, tool and result. |
Who approves a write action? | A person, before it runs. |
Also ask who will own the server's code. When a client requires owning the code, Wama moves the project to custom development, and the same logic applies here: an MCP server that touches your data should live in your account, as explained in the article on custom software where you own the code.
Common mistakes
Installing a server from the internet without review. An open-source MCP server is a dependency like any other and can bring malicious code.
Using a service account with access to everything. The AI ends up seeing what no user should see, and the audit loses track of who asked.
Relying only on the gateway. If permission checks live in a single place, one failure there opens up everything else.
Enabling writes in the first month. Opening tickets, sending emails or changing records without human approval turns a model error into a company error.
Not measuring. Without call logs, nobody knows whether the assistant helped or just spent money. The same product discipline that guides SaaS development applies: hypothesis, real usage, adjustment.
Frequently asked questions
Does MCP replace an API?
No. The MCP server usually sits in front of existing APIs and describes them in a way the AI model understands. The API keeps doing the work, with its own permission rules. That's why security has to exist in both layers, and not only in the newly installed MCP server.
Do I need a custom MCP server?
It depends on the system. Large tools, like Microsoft 365, already have official servers, and it's worth starting with those. An internal or legacy system, or one with its own business rules, almost always calls for a custom server, with tools designed for what the team actually needs to look up and nothing more.
Is MCP safe for sensitive data?
The protocol can be used securely, but it doesn't guarantee security on its own. The specification defines authorization with OAuth 2.1, and OWASP lists ten risks, still in beta. With sensitive data, start read-only, with the user's own identity, a log of every call and human review of what goes out.
Does Wama use AI in its own products?
Yes. ManyFeed, Wama's own social proof SaaS, was built with AI. In day-to-day project work, AI goes into code and automation, with Claude Code and Framer's agents, and no output reaches the client without a human read first. Product decisions are still made by people.
Where should a company start an MCP project?
Pick a process with lots of repeated lookups and little risk, like checking an order's status. List the minimum tools, read-only, connect them with the user's identity and log everything for a few weeks. Once usage is measured, discuss which writes are worth human approval and the investment.
If your company is thinking about connecting AI to its own system and wants to start with the right scope, talk to Wama about the project.
