Connecting your systems to AI, safely

Most businesses run on systems that don’t talk to each other. The ERP holds the orders. The file server holds the contracts. A database holds the customers. Ask a simple question that spans two of them, and a person spends an afternoon exporting, pasting and reconciling.

AI tools have made that gap more expensive. A capable assistant is only useful when it can see your data, and most company data sits exactly where the assistant can’t reach it.

The wrong ways to connect AI to your systems

The common workaround is manual: copy a record out of the ERP, paste it into a chat window, copy the answer back. It works once. As a practice, it’s slow, error-prone, and it quietly moves sensitive data through personal accounts and clipboards where no policy can see it.

The other workaround is one-off integration: a custom export here, a scheduled dump there, a bespoke connector for every tool that comes along. Each one is another credential to manage, another format to maintain, another hole in the wall. Ten tools, ten holes, and nobody with a full list of them.

What MCP is

MCP, the Model Context Protocol, is an open standard for connecting AI tools to data and systems. Instead of wiring every AI tool to every system, you stand up one MCP server in front of your data. The server exposes exactly the records and actions you choose, nothing more, and any compatible AI tool can then use it.

In practice, an MCP server is a small piece of software that sits next to your systems, inside your own environment. It speaks to the ERP, the file store or the database on one side, and speaks the protocol on the other. Nothing about your existing systems has to change; they don’t need to know AI exists at all.

Think of it as a doorway you build and control:

• You decide what’s visible. Which systems, which tables, which folders, which fields. Everything else simply doesn’t exist as far as the AI is concerned.
• You decide what’s possible. Read a record, search a folder, draft a document, each capability is exposed deliberately, one by one.
• You decide who gets through. Permissions sit on the doorway, so the same rules apply no matter which assistant is knocking.
• Everything passes one point. One place to log, one place to audit, one place to switch off.

One controlled doorway instead of ten holes in the wall.

Because MCP is an open standard, the doorway isn’t tied to one vendor’s assistant. The server you build today works with compatible tools you adopt tomorrow. The investment sits with your data, where it belongs, not with whichever AI product is fashionable this quarter.

Read-only where read-only is right

Most business questions are read questions. What did we quote? What’s on hand? Which contracts mention this clause? An MCP server can be built strictly read-only: the assistant can look, summarise and cross-reference, and can’t change a single record. For systems of record, accounts, payroll, inventory, that’s usually exactly right.

Where write actions are genuinely useful, they’re exposed deliberately and kept behind approval. The assistant prepares the draft; a person authorises it. It’s the same rule we apply to privately hosted AI: the system proposes, a person decides.

What the work looks like

A few examples in practice:

• An ERP exposed read-only, so an assistant can answer “what did we quote this customer last year?” without anyone building an export.
• A contracts folder exposed as searchable context, so questions are answered from the actual documents rather than from memory.
• A reporting database exposed with field-level filtering, so personal data is masked before the model ever sees it.

In each case the work is the same: decide what should be visible, decide what should be possible, put permissions and logging on the doorway, and connect. The AI tool on the other side can change; the doorway stays.

Where this fits

We build MCP servers as part of integration work, alongside interfaces, data migration and consolidation. If your systems don’t talk, and you want AI to be useful without punching new holes in your security, see Integration & data or write to us with the systems you have.