MCP: one secure access point for your AI agent to all your systems

What an MCP server lets your AI agent do

• An AI agent that looks up customer data in your CRM
• Prepare tasks and draft emails instead of sending them directly
• Request data from your accounting for an overview
• An assistant for your team that looks in several systems at once
• Hook up new integrations later without rebuilding the agent

How the integration works

Every action the agent may take is a separate tool with its own permissions: reading is different from writing, and writing with consequences requires approval. The MCP server logs every call. n8n has an MCP Server Trigger and an MCP Client Tool for this; the workflows behind them simply use the integrations you already have.

Facts about the MCP API

Checked on 2 November 2026 against the official documentation. Limits, prices and versions change; the source is listed per row.

Fact	What the documentation says	Source
Protocol version	2026-07-28. Older versions are considered legacy.	MCP: Versioning
Transport	stdio and Streamable HTTP through a single endpoint. The old HTTP+SSE transport has been deprecated since March 2025.	MCP: Streamable HTTP
Authentication	Optional in the standard. For HTTP: OAuth 2.1 with a Bearer token, never in the URL; the server publishes metadata as a resource server.	MCP: Authorization
Rate limits	Not in the standard. I handle that in the server itself, per tool and per client.	MCP: Specification
Building blocks	Tools, resources and prompts over JSON-RPC 2.0.	MCP: Specification
n8n	MCP Server Trigger (SSE and Streamable HTTP) and MCP Client Tool for an AI agent.	n8n documentation
Own server	mcp.aiagentcycle.com/mcp: read-only, Streamable HTTP, with the same content as this website.	AIAgentCycle llms.txt

What you need on your side

• A list of tasks the agent may perform, split into reading and writing
• Per write action: who approves before it happens
• The integrations with your systems, existing or to be built
• An AI assistant or agent that supports MCP, such as Claude, ChatGPT or an n8n agent

Where it often goes wrong, and how I prevent it

• Permissions that are too broad: an agent only gets the tools it needs, not your whole system.
• No trail: without logging, nobody knows what an agent has done. Every call is recorded.
• Writing without approval: actions with consequences, such as sending or booking, are set aside for a person.
• Instructions in data: text in an email or document can try to steer an agent. The tools check what is allowed, regardless of what the text says.

In practice

I run an MCP server in production myself. That is how I know what matters in practice: narrow tools, clear permissions and a full trail of every action.

What it costs

I build an MCP server with the first tools as one scoped process for a fixed price, from €750. Maintenance and monitoring are a monthly fee: n8n management from €250 per month, server management €145 per server. In the free assessment we work out your process. All prices and what is included →

What I do not do

• I never give an agent your whole system; only narrow tools with their own permissions.
• I do not use the deprecated HTTP+SSE transport for new servers.
• I do not let an agent perform irreversible actions without logging and approval.

Frequently asked questions about an MCP server

What is MCP?

An open standard that lets AI assistants and agents use tools in a fixed way. Built once, a tool can be used by different AI models.

Is this safe for my business data?

As safe as the limits you set. That is why every tool gets its own permissions, every action is logged and actions with consequences require approval.

Does this work with ChatGPT or Claude?

Yes. MCP is supported by various AI assistants and agents, and the server runs in your own environment.

Which MCP version and transport do you use?

The current specification (2026-07-28) over Streamable HTTP, with a single endpoint. The old HTTP+SSE transport has been deprecated since March 2025. My own MCP server at mcp.aiagentcycle.com runs this way, read-only.

How do you control access to an MCP server?

The standard leaves authentication open, but for a server over HTTP I use OAuth 2.1 with Bearer tokens, never a token in the URL, and separate permissions per tool. I do not put a server online without access control.