Connect the intelligence.
Control the access.
Create explicit interfaces between AI tools and the systems they are allowed to use.
Explicit interfaces between AI and the business systems it is allowed to use.
Built around the work.
Not the workaround.
Potential capabilities to explore during discovery. The right combination depends on your systems and requirements.
Defined tool access
Expose only the specific resources and actions a workflow needs.
Clear boundaries
Keep authentication, authorization, and review requirements explicit.
Operational traceability
Record requests and actions so an operator can understand what happened.
What is a custom MCP server?
A custom Model Context Protocol server exposes selected resources, prompts, and tools from an existing system to compatible AI applications through a standardized protocol. Production work includes capability design, typed schemas, authorization, consent, least-privilege backend access, validation, logging, compatibility tests, and deployment; MCP does not make an unsafe API safe by itself.
See the work
move forward.
Explore a conceptual workflow. Start the example, review the decision, and approve the next step.
An invoice arrives. See how the information moves to a reviewed record.
An order arrives. Follow one record across connected systems.
A request arrives. Watch an agent prepare the work without taking the final decision.
Where this fits.
And where it doesn’t.
The second list is the more useful one. We would rather say no early than bill for a build that was never going to hold.
A good fit when
- Target hosts or clients support the required MCP revision and capabilities.
- The underlying systems have stable data and action interfaces that can be narrowed safely.
- Users, roles, consent, scopes, prohibited actions, and review points can be defined.
- The organization benefits from a reusable protocol boundary rather than one application-specific API wrapper.
Not the right build when
- The need is only a static answer or document search without a compatible MCP client.
- The backend lacks a stable or authorized way to retrieve data or perform the proposed action.
- The design assumes the model, host, server, tool description, or retrieved content is automatically trusted.
- High-impact writes would be enabled before read-only use, review, recovery, and audit are proven.
More than a build.
A working capability.
Deliverables, responsibilities, and acceptance decisions are agreed in writing for the engagement. No price or schedule is implied here.
Capability and threat model
Hosts, clients, users, resources, prompts, tools, trust boundaries, scopes, consent, prohibited actions, and failure consequences.
MCP server implementation
Protocol handling, discovery, typed schemas, pagination or tasks where needed, errors, cancellation, and backend adapters.
Authorization and data controls
OAuth or appropriate transport identity, scope design, token validation, backend least privilege, minimization, and secret handling.
Tool safety and compatibility tests
Schema validation, destructive-action checks, user confirmation, adversarial inputs, client compatibility, version negotiation, and regression coverage.
Deployment and operator handoff
Environments, logs, alerts, rate and usage controls, runbook, incident and rollback path, client setup, and maintenance ownership.
A few useful answers.
Start with a conversation. The detail belongs in discovery and the written scope.
Published by Vail Valley AI Engineering Team · reviewed . Editorial policy
Does every AI application support MCP?
No. Support varies by product, deployment, transport, authorization, protocol revision, and feature. The target clients must be confirmed before designing the server.
Is MCP an API replacement?
Usually not. An MCP server often wraps governed capabilities from existing APIs or services. The backend still needs authentication, authorization, validation, reliability, and ownership.
Can an MCP server be read-only?
Yes, and that is often the appropriate first release. Resources and read-only tools can prove identity, relevance, performance, and client compatibility before any write action.
How is access controlled?
The approach depends on transport and client, but should validate the caller and intended resource, request minimal scopes, enforce backend permissions, protect tokens, and preserve user control.
How do you test MCP tools?
Test schemas, normal and invalid arguments, authorization boundaries, user confirmation, backend failures, duplicate calls, malicious context, compatibility, and recovery—not only a successful demonstration.
Bring us your
biggest challenge.
Whether you have a clear plan—or just a “there has to be a better way”—we’d love to hear from you.
Talk about mcp servers
Tell us what’s slow, manual, or breaking. We’ll say honestly whether it’s worth building—including when the answer is no.