For eighteen months, "connect the LLM to our systems" has meant one of two things: a brittle pile of function-calling glue, or a walled-garden plugin store. In 2026, a third option finally became credible - the Model Context Protocol, or MCP - and the mid-market clients who moved on it first are the ones now shipping useful AI features on a monthly cadence instead of a quarterly one.
What MCP actually is (in one paragraph)
MCP is an open protocol - originally proposed by Anthropic in late 2024, adopted broadly across model vendors through 2025 and 2026 - that standardises how an AI model talks to external tools, data sources and business systems. Instead of writing bespoke function-calling schemas for every model and every tool, you expose your systems once as an MCP server; any MCP-aware client - Claude, ChatGPT Enterprise, Cursor, your internal agent - can then discover and use them. The parallel we keep coming back to on client calls is USB: nobody misses the era of a different cable per device.
Why every CIO is quietly rewriting their AI roadmap
Three things converged in the first half of 2026. First, MCP support shipped natively in the enterprise tiers of every major model vendor, so procurement teams stopped treating it as a research curiosity. Second, the major productivity suites - Microsoft 365 Copilot, Google Workspace, and yes, Zoho - all published first-party MCP servers, which means "connect Copilot to our ERP" stopped being a six-month integration project. Third, the security story got real: signed servers, OAuth 2.1 flows, scoped permissions, audit trails. It is finally boring enough for a CISO to sign.
The practical consequence is this: the RFPs we responded to in Q4 2025 asked for "AI features". The RFPs we are responding to now ask for "an MCP layer over our core systems". That is a very different, and much healthier, question.
MCP is not a model, a product or a vendor. It is a wire format. Which is exactly why it is going to win - the same way HTTP, SMTP and USB won.
A reference architecture that works in the mid-market
This is the shape we deploy for a typical 100-500 person business. It is deliberately unglamorous and deliberately boring - which is the point.
The four layers
- 01Identity & gatewayOne MCP gateway in front of everything, sitting behind your existing SSO (Entra ID, Google, Okta). Handles OAuth 2.1, token exchange, per-user scoping, and structured audit logs.
- 02Server catalogueA small internal registry of approved MCP servers - CRM, ERP, ticketing, data warehouse, internal docs - each with a signed manifest, an owner and a review date. No shadow servers.
- 03Policy layerOPA/Cedar-style policies that decide, per request, which tools the calling identity may invoke, on which records, with which write scopes. The place where 'the intern's AI agent can read invoices but not export them' actually lives.
- 04ObservabilityEvery tool call captured with prompt, arguments, response, latency and cost. Fed into your existing SIEM. This is what turns 'AI experiment' into 'auditable enterprise system'.
If you already run a modern cloud landing zone and a real identity plane, this is a 6-8 week build, not a re-platforming exercise.
Four MCP server patterns we deploy in production
1. The read-only insights server
Wraps your data warehouse (BigQuery, Snowflake, Fabric) and exposes a small set of well-named, well-scoped query tools - not raw SQL. This is the safest, highest-ROI first server for most clients. Sales asks "which accounts have slipped this week", the agent hits list_slipping_accounts, and nobody had to build a dashboard.
2. The CRM action server
A thin MCP wrapper around your CRM's write APIs - Zoho, HubSpot, Salesforce, Dynamics - with per-tool policy. Read is broad, write is narrow: log a call, create a task, update a stage. Anything destructive (delete, merge, mass-update) is either disabled or requires a second-factor confirmation from the human in the loop. Pair with our HubSpot practice for a working baseline.
3. The internal knowledge server
RAG over SharePoint, Confluence, Google Drive and Zoho WorkDrive, exposed as MCP tools with document-level ACL enforcement inherited from the source. Boring, essential, and the single biggest driver of Copilot / ChatGPT adoption inside the businesses we advise.
4. The workflow-trigger server
Fires n8n, Make, Zapier or Zoho Flow workflows from the LLM. Where "agentic" actually earns its keep - see our earlier field report on agentic AI for SMBs for the patterns that pay for themselves.
Security, auth and blast-radius controls
Every serious MCP deployment we ship shares four non-negotiables: OAuth 2.1 with PKCE for user-context calls, signed server manifests, per-tool scopes attached to the token (not the server), and short-lived tokens with a mandatory refresh path. On top of that, three practical controls stop most incidents before they happen:
- Rate limits per identity, per tool, per minute. Cheap, boring, prevents 90% of runaway-agent stories.
- A hard allow-list of tools per business role, reviewed quarterly by the data owner - not IT.
- Every write goes through a signed intent object the human approved. No implicit writes from prompt content.
If any of the above is missing when you go live, roll back. Our VAPT team treats MCP gateways as a top-three attack surface for 2026 engagements - because in practice, they are.
A 90-day rollout plan for a 200-person business
Weeks 1-3 · Foundations
Stand up the MCP gateway behind SSO. Pick a single read-only server (usually the data warehouse). One team, one use case, no writes. Instrument everything.
Weeks 4-7 · First real workflow
Add the CRM action server with a narrow write scope for one team - typically SDR pipeline hygiene or support ticket triage. Weekly review of tool-call logs with the business owner. Kill anything nobody uses.
Weeks 8-12 · Knowledge and scale
Ship the internal knowledge server with source-inherited ACLs. Onboard two more teams. Publish an internal MCP catalogue page. Write the change-review process for new servers. Hand over to internal IT with a runbook.
Ninety days in, a 200-person business will typically have three servers live, six teams using them, and a working audit trail. That is the outcome to aim for - not a moonshot autonomous-agent demo.
Five mistakes we see and how to avoid them
- 01Exposing raw SQL or raw APIs as tools.
Wrap them. Name them. Scope them. If a tool name would embarrass you in an incident report, rename it.
- 02Skipping the gateway.
Point-to-point MCP servers per app is the new point-to-point integration. You will regret it in month four.
- 03Treating MCP as an AI project.
It is a platform project that AI happens to consume. Owned by platform engineering, sponsored by the CIO.
- 04No cost caps.
Per-identity, per-day token budgets. Alert at 70%. Cut off at 100%. You will thank us on the first Monday of the month.
- 05Buying a 'MCP platform' before you understand the protocol.
It is 40 pages. Have your platform lead read it before signing anything.
Where RanWebs fits
We design and ship MCP gateways, servers and policy layers for mid-market and enterprise clients across the US, UK, EU and APAC. Typical engagement is 6-12 weeks, fixed-price milestones, one senior lead, weekly demos. If your priority is CRM or productivity-suite integration, we usually pair the work with our HubSpot or Microsoft 365 practice so the tools your teams already use become MCP-native without a rip-and-replace.
First call is free - a senior consultant, not an SDR - and we will tell you honestly if MCP is the right lever for you this quarter. Reach us at info@ranwebs.com or via the contact page.