"When a mid-sized company should build a custom MCP server, when a vendor's official one is enough, the tools an ERP MCP server should expose, how MCP servers are structured and hosted, and the security rules from the MCP documentation that a company server must follow."
Key Takeaways
- 1MCP is an open-source standard for connecting AI applications to external systems. A custom MCP server exposes only the tools, data and prompts you choose.
- 2Check for an official server first. HubSpot, for example, publishes one that gives MCP-compatible AI tools secure read and write access to HubSpot CRM data.
- 3Build custom when your ERP or legacy system has no server, when you need narrower business-level tools, or when one action spans several systems.
- 4Expose business actions (check stock, get customer price, create draft sales order), not raw database access.
- 5Host company servers remotely over Streamable HTTP in your own cloud account, with OAuth as MCP recommends, rather than as local servers.
- 6Follow the MCP security guidance: token passthrough is explicitly forbidden; keep scopes minimal; validate everything.
- 7US searches for "custom mcp server" rose about 70-fold in a year (DataForSEO, 17 October 2026).
The short answer
A custom MCP serverlets AI clients such as ChatGPT, Claude or your own agents use your ERP or CRM through a small set of approved actions, like checking stock or creating a draft order, under your permissions and logs. Use a vendor's official server when one exists and fits. Build custom when your system has none, or when you need business-level tools that span several systems.
We build custom MCP servers and integrations, so weigh this page with that in mind.Facts about MCP come from the official Model Context Protocol documentation and HubSpot's developer page, opened on 17 and 18 October 2026 and linked where they appear. Search figures are our own DataForSEO measurement for the US on 17 October 2026.
US searches for "custom mcp server" reached about 1,000 a month in October 2026, roughly 70 times a year earlier, alongside 1,000 for "salesforce mcp server", 590 for "servicenow mcp server" and 390 for "hubspot mcp server" (DataForSEO, 17 October 2026). Behind those numbers is a simple request from staff at mid-sized companies: "let me ask ChatGPT or Claude about our orders and customers, safely." An MCP server is how you answer it.
Searches also run for slack, snowflake and sap mcp server, and for how to build, create or start building an MCP server (DataForSEO, 17 October 2026). This guide answers the company version of that question.
What MCP is, in one paragraph
The Model Context Protocol documentation describes MCP as an open-source standard for connecting AI applications to external systems, and compares it to a USB-C port for AI applications. An AI application (the host) creates one client per server it connects to. The server is your program, and it decides what the AI can see and do.
How an MCP server is structured
| Part | What it is (MCP architecture overview) | In an ERP server |
|---|---|---|
| Tools | Executable functions the AI can invoke: API calls, database queries | check_stock, create_draft_sales_order |
| Resources | Data sources that provide context: file contents, records, API responses | The price list structure, a customer record |
| Prompts | Reusable templates that structure interactions | A template for answering an order-status question |
| stdio transport | Local, between processes on one machine | Development and personal tools |
| Streamable HTTP transport | Remote; supports standard HTTP authentication; MCP recommends OAuth | A company server in your cloud account |
Source: the MCP architecture overview, read on 18 October 2026.
Official server or custom server?
Check your vendor first. HubSpot's developer page, for example, describes an MCP server that gives any MCP-compatible AI tool or agent secure read and write access to your HubSpot CRM data. If an official server covers what you need, use it.
| Situation | Use | Why |
|---|---|---|
| Your vendor publishes a server and its tools fit | Official server | Maintained by the vendor; nothing to build |
| Your ERP or older system has no server | Custom server | Nothing else will expose it to AI clients |
| The official server exposes more than you want AI to touch | Custom server in front | Narrower tools and your own limits |
| One action spans CRM, ERP and email | Custom server | Business-level tools that combine systems |
| Data sits on your own servers, not in the cloud | Custom server | Runs where it can reach the data |
The tools an ERP MCP server should expose
Here is a starting tool list for an order-to-cash server on an ERP such as NetSuite, Odoo, SAP Business One or ERPNext. Each tool does one business job, validates inputs, and returns structured results.
| Tool | What it does | Access |
|---|---|---|
| find_customer | Look up a customer by name, email, account number or PO | Read |
| get_order_status | Status, ship date and tracking for an order or PO number | Read |
| check_stock | Available quantity for an item at a location and date | Read |
| get_customer_price | Price for a customer and item from their price list | Read |
| get_invoice | Invoice details or a copy by number | Read |
| create_draft_sales_order | Creates a draft (never released) with an idempotency key from customer and PO | Write, draft only |
| attach_document | Attaches a source PDF to an order or customer record | Write |
Notice what is missing: no "run any query", no price changes, no payments, no deletes. Those either do not belong in an AI tool or belong behind a person's approval. Our agentic AI architecture guide shows where this server sits between the agent and your systems.
Want AI to use your ERP or CRM safely?
Tell us the system and the questions or actions your team wants from ChatGPT, Claude or an agent. In a 30-minute call with founder Bhavesh Barot we will check whether an official server exists, sketch the tool list, and point out what should need approval. FactoryJet quotes a fixed price in writing after that call.
Talk to the FounderSecurity rules from the MCP documentation
The MCP security best practices are written for implementers. The rules that matter most for a company server:
- No token passthrough. Explicitly forbidden: accept only tokens issued for your server, and use your own credentials downstream.
- Per-client consent if your server proxies a third-party API with a static client ID, to avoid the confused deputy problem.
- Exact redirect validation and single-use, short-lived OAuth state values.
- Block private network addresses when fetching URLs, to prevent server-side request forgery.
- Bind state handles to the user; never treat holding a handle as proof of identity.
- Minimal scopes, with step-up only when a higher-risk tool is first used.
On top of that, apply least privilege downstream: the server's own ERP account should be read-only except for the specific write tools you list. The wider agent risks are in our AI agent security guide.
How to build an MCP server for company systems: seven steps
- List the questions and actions staff and agents need, in their words.
- Check for an official server and what it already exposes.
- Turn the list into business-level tools with input schemas and clear descriptions.
- Map each tool to the exact API calls and fields in your systems.
- Start read-only; add write tools one at a time, with validation and idempotency keys.
- Host remotely in your cloud account with OAuth, logging and rate limits.
- Test from each AI client that will use it, including requests it should refuse.
MCP server, custom agent, or both
A custom agent can call your APIs directly, so MCP is not required for one agent. It pays off when several AI clients will use the same systems: staff in Claude or ChatGPT, a support agent, an order-entry agent. Permissions, tools and logs are then defined once. If your company runs on Salesforce, an Agentforce agent can reach the same backend through an API built alongside the server; see Agentforce pricing vs a custom AI agent. On Microsoft 365, Copilot Studio can call an MCP server as a tool, so the same back end can serve a Microsoft front end.
What else ranks for "custom mcp server", and how this guide differs
These are the business sites on Google's first page for "custom mcp server" in the US when we checked on 17 October 2026 (DataForSEO), with the title Google showed for each. We list them so you can compare; we have not reviewed their services, and the list leaves out forums and video sites.
| Site | Page title shown in Google |
|---|---|
| infracloud.io | How to Build Your Own MCP Server |
| learn.microsoft.com | Microsoft Learn MCP Server overview |
| blog.cloudflare.com | Build and deploy Remote Model Context Protocol (MCP) ... |
| builder.aws.com | Getting Started with MCP Servers: The Beginner's Guide |
Most of these are developer tutorials for a first server. This guide is for the company deciding whether it needs one: when an official server is enough, which tools an ERP server should expose, and the security rules a company server must follow.
How FactoryJet builds MCP servers
We build custom MCP servers and API integrations for ERPs, CRMs and other business systems, and we have worked on Odoo, NetSuite, SAP Business One, ERPNext and custom ERPs. You own the code and repository from day one, and hosting can sit in your own cloud account at cost. We show the server working against your own systems before you sign. FactoryJet quotes the build, and any support you choose, as fixed prices in writing after a short scoping call.
See AI integration services, AI agents for ERP systems, NetSuite AI agents and Odoo AI agents.
Sources
Pages opened and read on 17 and 18 October 2026.
- Model Context Protocol, What is the Model Context Protocol (MCP)?
- Model Context Protocol, Architecture overview
- Model Context Protocol, Security Best Practices
- HubSpot, MCP server developer page
- Our own measurement: US search volumes and year-on-year change, DataForSEO, 17 October 2026
MCP server scoping for mid-sized US companies
Let ChatGPT, Claude and your agents use your ERP, under your rules
Tell us the system and what people want to ask or do. We will design the tool list, the permissions and the approvals, and show the server working against your own data before you sign. FactoryJet quotes a fixed price in writing after a short scoping call.
Frequently Asked Questions
What is a custom MCP server?
Can I create my own MCP server?
Is it hard to create an MCP server?
What is the structure of an MCP server?
Do I need a custom MCP server if my software vendor already has one?
Why would a company build an MCP server for its ERP?
What tools should an ERP MCP server expose?
Can I run MCP servers locally?
How can I host my own MCP server?
How do you secure an MCP server?
What is token passthrough and why does it matter for MCP servers?
Can an MCP server write data, or only read?
Which AI clients can use an MCP server?
Are MCP servers obsolete?
What does an MCP server cost to run?
What is the difference between an MCP server and an API?
Can one MCP server cover several systems?
Do we need MCP if we are building a custom AI agent anyway?
Is there a free MCP server I can use for testing?
Does FactoryJet build MCP servers?
Can you give me an example of an MCP server?
Does Microsoft have an MCP server?
Bhavesh Barot
Founder & CEO
Founder & CEO of FactoryJet, an ecommerce and AI services company that has served 500+ businesses since 2014. Writes about ecommerce builds, AI agents, and AI search.
Related reading
- Agentic AI Architecture for Mid-Sized Companies: A Reference Diagram and the Choices Behind It (2026)A five-layer reference architecture for agentic AI at a mid-sized company: where work arrives, the agent, the tool layer where permissions live, your ERP and CRM, and the control layer. With the five workflow patterns, when to go multi-agent, how MCP fits, and a worked example from emailed purchase order to draft sales order.
- Agentic AI in Manufacturing: 9 Use Cases for Mid-Sized Manufacturers, With the Systems Each Touches (2026)Nine agentic AI use cases for mid-sized manufacturers, from RFQ quoting and PO-to-sales-order entry to supplier follow-up, shortage alerts, NCR drafting and drawing revision checks, with the ERP data each needs, what a person approves, and why agents stay out of machine control.
- AI Agent Governance for Mid-Sized Companies: The Policy to Set Before an Agent Goes Live (2026)A working AI agent governance policy for a company of roughly 100 to 2,000 people: four autonomy levels, written approval limits, access rules, logging, testing and an off switch, mapped to NIST AI RMF, OWASP LLM06 and ISO/IEC 42001. Includes a free, editable policy template.
- How to Build a Custom AI SDR for B2B Sales: Speed to Lead, Qualification & CRM Sync (2026)A comprehensive 3,500+ word engineering blueprint for building an autonomous AI Sales Development Representative (SDR): sub-60-second speed-to-lead, firmographic enrichment, ICP qualification logic, calendar booking, and CRM synchronization.
