Why AI agents need access to corporate systems
In a previous article on this blog, we described how AI agents are transforming business process automation. But a question immediately arises that can bring the entire project to a halt.
How does an AI agent actually access data in the CRM? Who controls what is allowed to be read and what isn’t? And how can you avoid having to program a custom integration from scratch for every new tool?
This question isn’t a technical detail. It’s a business blocker. Companies that don’t solve it well will either not deploy AI agents at all or end up with a chaotic network of proprietary connectors—expensive to maintain and risky from a data security perspective.
Model Context Protocol, or MCP for short, is the answer the entire market has been waiting for.
What is MCP, and how did it become a standard in just one year
Anthropic (the creator of Claude.ai) released MCP in November 2024 as an open standard for connecting AI models to external data sources and tools. In just twelve months, the experimental project became the de facto standard. By the end of 2025, monthly downloads had exceeded 97 million.
What MCP solved is known in technical terminology as the N×M problem. Imagine a situation where you have ten different AI tools and ten corporate systems. Without a common standard, this could mean up to a hundred different integrations, each custom-built. A Boston Consulting Group analysis described it succinctly: without MCP, integration complexity grows quadratically with the number of systems. With MCP, it grows linearly. For larger organizations, this is a crucial difference.
An analogy with USB-C best illustrates this. Until recently, every phone manufacturer had its own connector. Every new device meant a new charger, a new cable, and new chaos. USB-C solved this with a single universal interface. MCP does the same for AI agents and enterprise systems.
In March 2025, the standard was adopted by OpenAI, and Google DeepMind and Microsoft actively support it. In December 2025, Anthropic donated the protocol to the Linux Foundation, where the Agentic AI Foundation was established, with participation from Anthropic, OpenAI, Microsoft, Google, AWS, Cloudflare, Bloomberg, and Block. This combination of companies is a strong guarantee that MCP is not just a passing trend, but an infrastructure that will be built upon for years to come.
How MCP works: three roles, one protocol
The MCP architecture operates with three roles. The business logic behind it is intuitive.
MCP host is the application or environment in which the AI agent runs. It could be your company’s internal chatbot, an enterprise platform for process automation, or a development environment like Cursor or VS Code.
MCP server is a standalone software program that sits alongside your company’s system and provides access to precisely defined functions. The Salesforce server can tell the agent: “You may read contact and opportunity records, but you may not delete or export anything.” The server for the accounting system sets a rule: “You may ask about the status of invoices, but payroll records do not exist for you.”
MCP client then handles communication between the host and the server according to a standardized protocol.
The result? The agent always knows exactly what they’re allowed to do. The system always knows who’s asking and why. No open API access, no hardcoded passwords in the code, no “just in case” access to everything.
Security that isn’t just on paper
Data security is a topic in the corporate environment that can halt any project. IT departments have every right to be cautious when a request comes in: “We need the AI agent to have access to the CRM.”
MCP addresses this directly in its protocol design by applying the principle of least privilege. Each MCP server defines specific capabilities, known as tools and resources. The agent does not gain access to the entire system, but exclusively to precisely defined functions. Communication takes place via a standardized protocol that is auditable from start to finish. Authentication is handled by a dedicated authorization server using the OAuth standard. The MCP server itself acts solely as a recipient of permissions.
What does this mean in practice for the security team? The security architect configures the MCP server for a specific system once and precisely defines what passes through it. When adding a new AI agent or tool, there is no need to repeat the entire security audit, as the rules are defined at the server level, not at the level of each individual agent.
Meanwhile, the protocol is actively evolving, and the community of security researchers is working to further strengthen it. June 2025 brought significant updates to the specification, tightening the authorization model and introducing protection against the misuse of access tokens. Enterprise requirements are visibly shaping this evolution.
Quantifiable business benefits
Let’s break this down in terms of real costs.
A typical company that wants to deploy AI agents across three processes (customer service, order processing, and reporting) must connect the agents to CRM, ERP, and the data warehouse. Without a standard, these are three separate integrations, each requiring its own development, testing, and documentation.
Each such proprietary integration represents two to four weeks of extra work. If you have an in-house team, these are costs. If you outsource, these are invoices. And in a year, when the system versions change, part of that work needs to be redone.
With MCP, integration time is significantly reduced. For the most widely used platforms, such as Salesforce, GitHub, or PostgreSQL, ready-made MCP servers exist, so the connection takes hours, not weeks. Every new AI agent or tool you add in the future will automatically work with all existing MCP servers. Once the integration is solved, it applies to all future agents. The more agents you add over time, the greater the return on that initial investment.
Microsoft has gone the furthest: at the Ignite 2025 conference, it announced that Dynamics 365 ERP is deploying a dynamic MCP server that provides agents with real-time access to hundreds of pre-built tools without the need for custom connectors. The result is agents capable of automatically processing orders, checking inventory levels, or generating financial reports. Manufacturing companies deploy agents that immediately propose alternative production plans following a machine failure, taking into account delivery deadlines and current capacities. These aren’t concepts from presentations; they are live deployments in production environments.
Where MCP helps in practice: industry examples
A good example from the Czech market that you may be familiar with as customers: Rohlík.cz operates its own MCP server, through which anyone can place an order via natural conversation with Claude or another AI assistant. This is a clear demonstration of how MCP works from the user’s perspective. If you want to experience MCP firsthand, this is the fastest way.
But Rohlík goes much further. Internally, they deploy AI agents that, instead of generating reports on missing supplier emails, directly update product descriptions in the system. According to available information, the accuracy of these updates is around 95%. The agent doesn’t present a table for a decision; the agent solves the problem. The result is a dramatic reduction in operational costs for the process. This is exactly the shift people are talking about when they say that AI agents are ceasing to be tools for analysis and are becoming tools for direct action.
Energy and utility companies are deploying AI agents for customer service. The agent needs access to customer contracts, consumption history, and invoice statuses, but must not have access to internal network operational data or employee payroll. The MCP server sets this boundary precisely and once and for all, without the need to repeat security settings with every subsequent deployment.
In the insurance industry, an AI agent helps process claims. It reads insurance policies but cannot modify them without human approval. Every query is audited, every action traceable.
Many companies approach this by starting with an internal use case: the agent answers employees’ questions using process manuals and an internal knowledge database. The MCP server provides access only to relevant documents, not the entire corporate drive. The pilot is quick, the results are measurable, and the security team is satisfied.
Leading Microsoft partners use MCP to automate responses to inquiries using historical CRM data; others streamline invoice processing through autonomous workflows. This isn’t the future—these are production deployments running today.
How to get started: from audit to pilot
You might be wondering: where do you actually start if you want to try MCP in your company? A good starting point is an audit of the company’s systems that AI agents would need to work with. For each, simply verify whether a ready-made MCP server is available at modelcontextprotocol.io or if it will need to be custom-developed.
Based on this, you can draw up a realistic plan with cost and timeline estimates. We recommend starting the pilot with a single process where the agent’s business value is clear and measurable. This will allow you to validate the entire architecture, gather data on actual savings, and build a case for expanding into other areas.
MCP is managed by the Linux Foundation and backed by Anthropic, OpenAI, Microsoft, and Google. The ecosystem of pre-built servers on GitHub continues to grow every month. This is infrastructure worth investing in.
Want to implement MCP in your company?
At eMan, we have experience designing and implementing AI solutions for medium and large companies, including connecting AI agents to corporate systems via MCP. We’ll help you identify where AI agents will bring the most value to your processes, design the architecture, and ensure secure integration with your existing systems.
Get in touch with us, and together we’ll figure out where to start.
FAQ About MCP
What is the Model Context Protocol (MCP)?
The Model Context Protocol is an open standard released by Anthropic in November 2024. It defines how AI models and agents securely and consistently access external data sources, tools, and enterprise systems such as ERP, CRM, or databases. In December 2025, the protocol was transferred to the Linux Foundation, where it is managed by the Agentic AI Foundation.
Why are companies switching to MCP instead of custom API integrations?
Custom API integrations are always tailored solutions for a specific combination of systems. MCP defines a unified protocol, so a single AI agent can work with any system supported by an MCP server without requiring new development for each connection. According to a BCG analysis, the complexity of integration grows linearly with MCP, whereas without a standard, it grows quadratically.
How does MCP ensure secure access to corporate data?
MCP operates on the principle of least privilege. Each MCP server precisely defines which functions and data are accessible through it. An agent cannot access anything that the server does not explicitly offer. Communication is auditable, and the June 2025 specification update introduced a stricter authorization model based on the OAuth Resource Servers standard.
For which enterprise systems are MCP servers available?
Off-the-shelf MCP servers are available for Salesforce, GitHub, PostgreSQL, Atlassian Jira and Confluence, Microsoft Dynamics 365, Google Drive, and dozens of other platforms. A complete overview is available at modelcontextprotocol.io. For specific internal systems, an MCP server can be custom-developed.
How long does it take to implement MCP in a company?
If a ready-made MCP server exists for your system, connecting the agent takes a matter of hours. If your system requires a custom-developed MCP server, the investment is in the range of days or weeks. However, this investment will pay off faster the more AI agents you connect to that system in the future.
