MCP development · Model Context Protocol
Connect each system once.For every agent and assistant.
At CoderConda you have MCP servers built through which your AI applications reach your ERP, file store and calendar. Each system is described once, as a tool. After that every application uses it through the server’s own account and with limited permissions, and every call is logged.
- Server
- 4 tools, 1 account
- Call
- erp.read_case
- Argument
- number: 2026-0188
- Response
- customer, 12 line items, locked
- Writing
- 1 of 4, approval only
- Log
- client, tool, duration
One tool per business task · reading and writing kept apart
01 — The arithmetic
4 × 4 or 4 + 4.16 integrations or 8.
Without a shared layer every application gets its own integration with every system. With an MCP server I describe each system once, and all applications speak the same protocol.
Every line is code somebody writes, tests and maintains. The fifth application brings 4 more.
The adapters sit on the right; on the left every application speaks the same protocol. The fifth needs one entry in the configuration.
With one application and one system a direct integration is faster. Then that is what I build.
02 — The tool
A tool is a description,not an endpoint.
The model reads name, purpose, parameters and limit, and decides from that whether to call the tool. An imprecise description only shows in the third month of operation, at an odd posting. That is why it is part of the work.
// Read only. Writing is a different tool with different permissions.{ "name": "erp.read_case", "description": "Reads one case by its number. Returns customer, line items and any lock reason.", "inputSchema": { "type": "object", "properties": { "number": { "type": "string", "pattern": "^\\d{4}-\\d{4}$" } }, "required": ["number"] }, "annotations": { "readOnlyHint": true }}// Limit: 60 calls per minute, no other tenants.4 tools, each with a limit of its own
erp.read_case
- Permission
- ERP readonly
- Limit
- No writing, no other tenants
files.search
- Permission
- Its own account, with the asker’s permissions on top
- Limit
- At most 20 hits per call
calendar.free_slots
- Permission
- Free/busy only, no content
- Limit
- No titles, no attendees, no writing
mail.create_draftwriting
- Permission
- Drafts folder
- Limit
- No sending · agent marker in the header
A limit in code, not in the prompt
Sending is not a parameter you could set to true. It is not a tool.
03 — The offer
Six parts,and none of them is the protocol.
Standing up an MCP server takes an afternoon. The weeks after that go into the adapters, the descriptions, and the question of what should happen on a timeout.
- 01
Tool boundaries
One tool per business task, not per database table. Fewer than most people build.
- 02
Adapters
Behind every tool sits whatever actually exists: REST, SQL, SFTP or an export folder.
- 03
Descriptions
Purpose, parameters, units and edge cases, in your company’s own vocabulary.
- 04
Permissions
An account of its own for the server, its own permissions per tool, reading and writing kept apart. When it searches, the asker’s permissions apply on top.
- 05
Log and caps
Every call with client, tool, duration and result, plus rate limiting.
- 06
Versions
Old names stay valid for a while and announce that they are retiring.
Duration
Tool boundaries 1 week, 1–2 weeks per system
Amount
After the first call, in writing
I name the amount in writing after the first call, before anything is built.
Handover
Source code, descriptions, permission model, tests and documentation. The server is yours.
04 — The questions
Six questions.The first one argues against me.
01Do I even need MCP?
Not with one application and one system. Then a direct integration is faster and cheaper, and that is what I build. MCP pays off as soon as several applications need the same systems, say an agent, an assistant and an editor. Then one description per system replaces one integration per pair.
02Is an MCP server a security risk?
It is as safe as the permissions behind it. The server gets an account of its own, every tool its own permissions, writing tools run only with approval, and every call is logged. A risk comes from a tool that may do more than it needs to.
03Where do the server and the data run?
In Germany, with a data processing agreement under the GDPR. On request the server runs entirely inside your own network, with no route outwards.
04What if my system has no API?
Then the work sits in the adapter. Database access, an export folder or SFTP disappear behind the tool. The application sees the same kind of description as for any other system and never learns whether REST or a folder sits behind it.
05Does this lock me into a vendor?
MCP is an open protocol and the server is your code. If you change the model or the application, the tools stay as they are.
06Can you review a server I already have?
Yes. What I find most often is a tool that may do too much, then descriptions that invite a call at the wrong moment. You get a list with finding, risk and effort, and half of it can be fixed in a day.
A seventh question? I settle it on the first call.
05 — Who builds it
One point of contact.Who also writes the adapters.
Damjan Savić built systems for large companies in the corporate world. He writes the adapters and descriptions for your server himself, takes over operation afterwards, and wherever money or commitment is involved there are tests.
- Damjan Savić
- Senior full-stack developer · founder of CoderConda
- Reachable
- No call centre, no ticket system.
- Location
- Bergisch Gladbach, on site in the Rhineland, remote everywhere else.
- More
- damjan-savic.com
06 — Appointment
Which three tools would an agentat your company need first?
Pick a time straight from the calendar and name the systems behind them. Typical ones are reading, searching and drafting. I will tell you which have an API and where the adapter is the real work.
The calendar is hosted by cal.com.
Loading it opens a connection from your browser to cal.com (USA), which transmits your IP address; cal.com may set cookies when it loads. You can also go straight there instead.