What is MCP and what does it mean for your ERP and CRM?

What is MCP?

MCP, short for Model Context Protocol, is an open standard for connecting AI assistants to the systems where your data lives. A system offers an MCP server that describes what the AI may read and do. Any assistant that speaks MCP, such as ChatGPT or Claude, can then use that server without a custom integration.

MCP works like a standard plug. Before MCP, every AI application needed its own integration for each system; now one MCP server per system fits every compatible assistant.

Three parts work together. The host is the AI application, such as ChatGPT, Claude or Microsoft Copilot; in Claude, MCP servers show up as Claude connectors. A client inside the host keeps the connection with one server. The server sits in front of a system, such as your ERP.

A server can offer tools (actions, such as creating a draft sales order), resources (data, such as records or documents) and prompts (templates for recurring tasks).

Who made MCP and who manages it now?

Anthropic, the company behind Claude, announced MCP on 25 November 2024 as an open standard. In December 2025 it was donated to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI. The current version of the specification is dated 28 July 2026.

Google, Microsoft, AWS, Cloudflare and Bloomberg support the foundation, so MCP does not belong to one AI vendor.

Why does MCP matter for ERP and CRM?

Because every major AI assistant can now reach the same business systems in the same way. ChatGPT, Claude, Gemini and Microsoft Copilot all support MCP, and vendors such as Microsoft, Salesforce and HubSpot have built official MCP servers. Connecting AI to your ERP or CRM is becoming standard work.

The hard questions move to who may see what, which actions are allowed and who keeps it running. Microsoft Copilot Studio has supported MCP since May 2025. If you switch to another AI assistant later, the MCP server stays in place.

Which ERP and CRM systems have an official MCP server?

As of September 2026, Business Central, Microsoft Dataverse, Salesforce and HubSpot offer an official MCP server. Exact Online has announced one without a date. AFAS has no official server, TOPdesk only a roadmap item, and SAP is partly planned. Check the vendor documentation before you decide.

Official means built and supported by the vendor. Third-party servers exist too, but then another party carries security and maintenance.

Official MCP servers per vendor, as of September 2026

What is the difference between MCP and an API?

An API is the interface a system offers to other software; a developer writes code that calls it step by step. An MCP server usually sits on top of that API and describes the actions so an AI model can choose which one to use. MCP builds on APIs and does not replace them.

• API: fixed calls written by a developer, the same steps every time.
• MCP server: a menu of described tools; the AI picks tool and input per question.
• Without an MCP server, an agent can still connect through the official API, with more build work and full control over the calls.

Is MCP safe for business data?

MCP can be used safely, but the standard does not make it safe automatically. The main risks are servers with broader rights than needed, prompt injection, tool poisoning and careless handling of access tokens. The specification requires user consent before tools are used and recommends giving each connection only the rights it needs.

Authorisation over the internet is based on OAuth 2.1. To use MCP safely, start with official servers and read-only access, let a person approve every write action and keep a log of what the AI did.

• Over-broad permissions: a server on an administrator account lets the AI do everything that account can. Use least privilege.
• Prompt injection: an email, document or ticket contains hidden instructions that the AI follows.
• Tool poisoning: a malicious server hides instructions in its tool descriptions. Treat descriptions from untrusted servers as untrusted.
• Token handling: the specification warns against token passthrough, session hijacking and confused deputy attacks.

What does enterprise MCP not arrange for you?

MCP arranges the connection between an AI assistant and one system. It does not decide who may see what across systems, who approves a write action, which business rules apply or who monitors the result. Whether AI actually works in your processes depends on those questions.

BeeManaged arranges this layer. Agents get only the rights their task needs, read-only by default. Write actions go through an approval queue in app.beemanaged.com, with an audit log per question and action. The agent prepares, your team decides.

• Role-based rights across systems: sales sees prices and customer history, not salaries.
• Approval of write actions: who checks a draft order or a changed delivery date before it is final.
• Business rules per process: discount limits, priority customers, when a question goes to a person.
• Monitoring and management: checking answers, updating tools, handling errors.
• Customer-facing channels: a customer or dealer on your website does not use ChatGPT with your ERP connected.

• How we build and manage an agent

What does MCP mean for a manufacturing company?

Most manufacturing companies run a mix of systems: an ERP such as Exact Online or AFAS Profit, a CRM, a service desk and documents. As of September 2026, only part of that mix has an official MCP server. An agent that works across your processes combines MCP where available with the official API elsewhere.

Take a sales office question: when does this dealer's order ship, and was last month's complaint resolved? The answer spans the ERP and the CRM or service desk; one MCP server reaches only one.

On Business Central, Salesforce or HubSpot, the official MCP server is a usable building block. We connect Exact Online and AFAS Profit through the official API. For employees asking their own systems questions, we build an internal agent with rights per role.

• Connect Exact Online to an AI agent
• Connect AFAS Profit to an AI agent
• Internal AI agent for your employees

When is an MCP server enough, and when do you need a managed agent?

If you only want to ask one system questions yourself, connecting its official MCP server to ChatGPT or Claude can be enough, and it is cheaper. A managed agent makes sense when several systems, roles, outside customers or approved write actions are involved, and someone has to keep it running.

A director asking HubSpot for this quarter's open deals does not need BeeManaged. A service process combining a ticket, the ERP and a customer conversation needs rules, rights and management.

Three routes to AI on your ERP and CRM

• Pricing
• Plan a conversation