# Connect your agents. Control what they can do. Secure MCP integration Connect AI agents to selected business APIs through MCP, with scoped access, validated tools, approval controls and auditable execution. ## One request through a controlled boundary Illustrative workflow. - Caller: A staff member with account access - MCP tool: Read the status of an authorised order - Business API: Return permitted fields and record the result ## Let agents use specific business functions Model Context Protocol connects an AI application to tools provided by a server. We scope the functions your business wants to expose, then put identity, validation and approval around each operation. ### Expose an approved operation, not a whole system An MCP server can wrap selected business APIs as named tools. An agent acting through an MCP client can discover and call those tools. Your CRM, accounting platform or internal application keeps its existing business rules. The server controls what the caller can do, even when the model asks for something else. Start with a narrow job such as finding an order status or preparing a service request. Define the accepted inputs, returned fields and permitted users. Avoid generic tools that execute arbitrary SQL, call any URL or make unrestricted changes. A read-only label in a tool description is not an access control. - **Read order status**: Order reference. Return only records and fields the caller may access. - **Prepare a CRM update**: Record ID and proposed changes. Validate the fields and show a draft without writing. - **Apply an approved update**: Approved change and record version. Check approval, current permissions and duplicate execution before committing. ### Check identity at every boundary For a remote HTTP deployment, design the authorisation flow around the supported MCP specification and your identity provider. Validate the intended token audience and required scopes. Keep downstream API credentials on the server rather than passing the client token through to another service. Scope every call to the correct person, organisation and record. A tool appearing in the catalogue does not authorise its execution. Apply checks again when the operation runs, including after an approval delay. An approval should refer to the actual change and its version so later edits cannot silently reuse it. ### Prove that unsafe calls stop and retries stay safe Treat retrieved documents and tool output as untrusted data. Test whether hostile instructions can trigger another tool, reveal a restricted record or redirect a request. Restrict outbound destinations, limit request size and execution time, and apply per-user and per-organisation rate limits. Rehearse revoked access, stale approvals, a provider outage and an interrupted write. Use idempotency and reconciliation where the underlying operation supports them. Keep an audit record of the requester, tool, authorisation result and outcome without logging secrets. Give the operating team a way to disable a tool and investigate a failed call. The first release should demonstrate one complete business task. Broader access comes after the organisation has evidence that the boundary holds and knows who owns the recovery process. ### References - [MCP tools specification](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) - [MCP authorisation](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) - [MCP security practices](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) ## Selected tools. Enforced permissions. ### A scoped tool catalogue Wrap selected business endpoints with typed inputs and limited outputs. Separate read, draft and write operations. ### Identity and approval Enforce caller, tenant and record permissions on the server. Tie approval to the exact proposed change. ### Operational protection Apply rate limits, execution budgets, audit records and recovery procedures for failed or repeated calls. ## Put the control in the server ### A universal connector A generic execute-anything tool can give a model more authority than the person using it. ### An approved operation The server validates the caller, record and requested change before invoking a business API. ## What needs attention in your system? Select the areas you want to discuss. The HTML page can download your selections. - [ ] A scoped tool catalogue: Wrap selected business endpoints with typed inputs and limited outputs. Separate read, draft and write operations. - [ ] Identity and approval: Enforce caller, tenant and record permissions on the server. Tie approval to the exact proposed change. - [ ] Operational protection: Apply rate limits, execution budgets, audit records and recovery procedures for failed or repeated calls. ## What your team receives Included scope agreed before delivery. - Tool and access register: The supported operations, schemas, roles, scopes and required approvals. - Boundary test evidence: Rejected cross-tenant calls, revoked permissions, prompt injection attempts and safe retry checks. - Operating handover: Monitoring, redacted audit events, credential rotation, rate limits and a tool disable procedure. ## Does MCP make an agent safe automatically? No. MCP provides an integration protocol. The application must enforce authorisation, input validation, approval, data minimisation and recovery. We begin with a small set of read-only operations and test prohibited actions before extending access.