Free guide

Connect your company to AI with MCP

How I connect tools and data to Claude, ChatGPT and coding agents through the Model Context Protocol, safely. Seven steps from the first read-only server to company-wide use.

What's inside

1. 1. Start with one question people ask every week

   • Pick a use case with a clear owner: weekly planning, a sales report, ticket triage, cost questions.
   • Write down which data the answer needs and who is allowed to see it.
   • Measure how long it takes today, so you can show the difference later.

2. 2. Know your data before you expose it

   • Classify every field: public, internal, personal, secret.
   • Personal and secret data stay out of the first version. Aggregates are usually enough.
   • Data that must never leave your network: serve it to a local model behind the same MCP server.

3. 3. Read-only first

   • The first server only reads: list, search, report. No create, update or delete.
   • One tool, one job, with a clear name and description the model can understand.
   • Small, structured answers instead of whole tables: faster, cheaper and less to leak.

4. 4. Identity and keys

   • Each user connects with their own identity (OAuth or OIDC), so the agent acts with that user's rights, never more.
   • API keys stored hashed, scoped per tool, with an expiry and a way to revoke them.
   • No shared admin token, ever.

5. 5. Pilot with one team

   • Five to ten people, two weeks, one channel for feedback.
   • Log every tool call: who, which tool, which parameters, how long, what came back.
   • Rate limits and a cost cap per user from day one.

6. 6. Add write actions behind a confirm step

   • Writes only where the pilot proved value, each one confirmed by the user before it runs.
   • Destructive actions (deleting, payments, permissions) come last, with an explicit confirmation and the same permissions as in the user interface.
   • Every write is reversible, or at least recorded with the state before and after.

7. 7. Scale and govern

   • An approved list of MCP servers and AI clients for the company; everything else blocked by policy.
   • New tools reviewed like code: pull request, security check, a named owner.
   • A monthly report on usage, errors and hours saved.

8. Rolling it out, by company size

   • Startup: one server for your own product, so customers and your team can work in it from their AI assistant.
   • Mid-sized company: one server per core system (ERP, CRM, ticketing) behind single sign-on.
   • Enterprise: a central gateway with an allowlist, audit logs and data classification, plus local models for confidential data.