MCP integrations
Custom MCP Server Development and MCP Integrations, With Guardrails Built In
We connect Claude and other AI models to your store, CRM, inbox and internal systems through the Model Context Protocol, with read and write access separated, every tool call logged and a person approving what matters.
What an MCP integration does for your business
The Model Context Protocol (MCP) is an open standard that lets AI applications such as Claude, ChatGPT and Cursor connect to outside tools and data in a consistent way. Anthropic introduced MCP on November 25, 2024, and in December 2025 donated it to the Agentic AI Foundation, a fund under the Linux Foundation. At that point Anthropic counted more than 10,000 active public MCP servers. Connecting AI to the systems where your data lives is the data side of AI enablement, and MCP is one standard way to do it.
An MCP server offers an AI model three things: tools it can call, such as create draft order; resources it can read, such as a product catalog; and prompts, which are reusable instructions. MCP doesn't replace your APIs. Most MCP servers wrap an existing API and add what a model needs: clear tool descriptions, scoped permissions and consent. See MCP vs API for the full comparison, or what the Model Context Protocol is.
Official MCP server or custom MCP server?
Many platforms now publish their own MCP servers. We configure an official server first and build a custom MCP server only when the job calls for it.
| Question | Official MCP server | Custom MCP server |
|---|---|---|
| Who maintains it | The software vendor | You, with documentation and optional support from us |
| Tool design | Generic tools that mirror the vendor's API | Task-level tools shaped around your workflow, such as prepare weekly reorder list |
| Business rules | Few or none; the model decides within the API's limits | Your rules enforced in code, such as discount caps or approval thresholds |
| Multiple systems | One system per server | One tool can read your CRM and write to your ERP in a single step |
| Best when | The vendor's server covers the job and its scopes can be limited | No server exists, the official one exposes too much or too little, or the task spans systems |
Official MCP servers we configure: Shopify, Klaviyo, HubSpot and n8n
Details as of October 2026. Vendors update MCP servers often, so we recheck documentation on every project.
Shopify MCP servers
Shopify's Dev MCP server helps developers search Shopify docs and explore API schemas; separate commerce MCP servers give shopping agents catalog, cart, checkout and customer account tools. Neither replaces a reviewed workflow for live store changes.
Learn moreKlaviyo MCP server
Klaviyo hosts a remote MCP server. A read-only setting disables every tool that can write to your account, and a toolsets setting limits the server to scopes you choose. Remote access requires an Owner, Admin or Manager role.
Learn moreHubSpot MCP server
HubSpot made its remote MCP server generally available in April 2026, with read access to CRM records and create and update access to contacts, companies, deals and tickets. Connections require OAuth 2.1 with PKCE.
n8n as an MCP bridge
n8n can call MCP servers from inside a workflow and expose workflows as MCP tools, so Claude triggers an approved, logged workflow instead of touching a system directly.
Learn moreWhen to build a custom MCP server
Build a custom MCP server when the AI needs to do a specific job that no official server does safely. The five situations we see most:
- No server exists for the system, common with ERPs, industry software and internal databases
- The official server exposes too much, such as delete or bulk-update tools you can't switch off
- The job spans systems, like checking stock in one tool before drafting a purchase order in another
- Business rules must live in code, not in a prompt: price floors, discount caps, approval thresholds
- Several AI clients or agents share the server, so logging and approvals belong at the tool layer
Good custom servers expose a few task-level tools, not every endpoint: one draft_supplier_reorder tool is easier for a model to use correctly, and for you to audit, than twenty raw endpoints. When the job is a full agent rather than one connection, see custom AI agent development.
MCP security: the controls we build into every MCP integration
Based on the MCP specification's security guidance (version 2026-07-28). MCP can't enforce these at the protocol level, so the implementation has to.
| Risk | What can go wrong | Control we build in |
|---|---|---|
| Over-broad scopes | One stolen or misused token reaches everything | Minimal starting scopes, read-only by default, extra access only for documented needs |
| Token passthrough | A server forwards tokens not issued for it, bypassing controls and audit trails | Servers accept only tokens issued for them and validate the audience, as the specification requires |
| Prompt injection | Text in an email, web page or review tells the model to do something else | Untrusted content treated as data, read and write tools separated, risky actions behind human approval |
| Untrusted local servers | A local MCP server runs code with the user's own access | Only reviewed servers, run with minimal privileges and removed when the project ends |
| Unreviewed writes | AI changes live records, prices or pages directly | Changes go to drafts or development environments first, and a person approves before anything goes live |
| No audit trail | Nobody can say what the AI did or why | Every tool call logged with user, tool, inputs and result; alerts to a named owner |
| Leaked secrets | API keys end up in prompts, documents or code | Keys in a vault under your company's accounts, rotated when staff or vendors change |
Read tools, write tools and review gates
The most useful MCP design decision is separating what the AI can read from what it can change. Read tools let Claude look up an order or pull last week's campaign results; mistakes there cost little. Write tools create, update, send or delete, so each gets its own scope, logging and, until it has earned trust, a person approving the result.
Platforms now support this split. Klaviyo's remote server has a read-only setting, and Anthropic lets Claude organization admins restrict actions within each MCP connector, such as allowing reads while blocking writes. Where a write is unavoidable, we route it somewhere safe first: a draft, a staging record or a development theme. Anything touching money, customers or published content stays behind an approval step, in line with your AI governance rules.
Case study: ROAM Luggage runs Shopify changes through Claude and MCP
ROAM Luggage, a premium DTC luggage brand, used to wait days for its web agency to make routine Shopify updates. Operator Intelligence built a workflow in six weeks: the team Slacks or emails a requested change, a custom n8n workflow saves it to a task repository, AI prioritizes the queue, and Claude executes each change via MCP inside a Shopify development theme. A ROAM team member reviews and publishes it.
The development theme is the safety line: no change reaches customers until a person approves it. Because the workflow replaced ROAM's web agency retainer, ongoing website management costs fell by more than 90%. Read the ROAM Luggage case study.
ROAM Luggage results with Claude via MCP
How we build an MCP integration
1. Define the job
What the AI should accomplish and which systems it must read or change. One integration, one clear job.
2. Choose official or custom
We test the vendor's MCP server against the job and its permission model before writing code.
3. Design tools, scopes and auth
A few task-level tools with the narrowest scopes that work, read and write kept apart, OAuth for remote servers and keys stored under your company's accounts.
4. Test on real and hostile inputs
Past cases from your business, plus inputs designed to trick the model, such as instructions hidden in an email.
5. Launch, hand over and monitor
Logging, alerts to a named owner, approval on risky actions, a runbook and training. Optional support covers vendor and specification changes.
Frequently asked questions
How much does custom MCP server development cost?
Cost depends on how many tools the server exposes, how many systems it touches, whether it needs write access and approvals, and hosting. Configuring an official server costs far less than building a custom one. Each integration is scoped and quoted as a discrete project, and you own the result; see how we price.
Is MCP secure?
MCP is a protocol, so security depends on how servers and clients are built and configured. The specification bases remote authorization on OAuth 2.1 and forbids token passthrough, but it can't enforce least privilege or human review. Those are implementation choices, and we build them into every integration.
Can AI edit our live Shopify store through an MCP server?
It can, but we don't set it up that way. In ROAM Luggage's workflow, Claude works in a development theme and a team member reviews and publishes every change.
Can we use the Klaviyo MCP server in read-only mode?
Yes. Klaviyo's remote MCP server has a read-only setting that disables tools able to write to your account, plus a setting that limits it to specific scopes. We often start there for reporting, then add reviewed write tools for specific tasks. Setup details are in our Klaviyo MCP and Claude integration guide.
Which AI tools can use our MCP server?
Any MCP client, including Claude, ChatGPT, Cursor and many agent frameworks, plus n8n workflows. We test with the clients your team uses, since each handles tool approval differently.
Connect AI to your systems without handing it the keys
Tell us which systems you want Claude or another model to work with. We'll recommend an official server, a custom one or a simpler integration. Or start with the free AI readiness assessment.
Book a scoping callSources
- Anthropic (2024): Anthropic introduced the Model Context Protocol on November 25, 2024
- Anthropic (2025): Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation (December 9, 2025); more than 10,000 active public MCP servers; adopted by ChatGPT, Cursor, Gemini, Microsoft Copilot, VS Code
- Model Context Protocol specification (2026): MCP servers offer resources, prompts and tools; MCP cannot enforce security principles at the protocol level, so implementors should build consent, access controls and data protections; current spec version 2026-07-28
- Model Context Protocol specification, Authorization (2026-07-28) (2026): MCP authorization for HTTP transports is based on OAuth 2.1; servers must validate token audience and must not accept or transit other tokens
- Model Context Protocol, Security Best Practices (2026): Token passthrough is explicitly forbidden; scope minimization, local MCP server compromise and confused deputy risks and mitigations
- Shopify (shopify.dev) (2026): Shopify Dev MCP server lets AI assistants search Shopify docs and explore API schemas
- Shopify (shopify.dev) (2026): Shopify commerce MCP servers: Storefront Catalog, Cart, Checkout, Customer Accounts and Order MCP (via UCP)
- Klaviyo developer docs (2026): Klaviyo remote MCP server (mcp.klaviyo.com/mcp); read-only parameter disables write tools; toolsets parameter limits scopes; Owner, Admin or Manager role required
- HubSpot developer changelog (2026): Remote HubSpot MCP server generally available April 13, 2026, with read access to CRM records and create/update access to contacts, companies, deals, tickets, line items and products; OAuth 2.1 with PKCE required
- Anthropic (claude.com blog, April 9, 2026) (2026): Claude admins can restrict which actions are available within each MCP connector, e.g. allowing reads while blocking writes
- n8n docs (2026): n8n MCP Server Trigger lets n8n act as an MCP server; MCP Client Tool lets an n8n AI agent use tools from an external MCP server
Related
All integrations
How we connect AI models to your systems.
Claude + Shopify integration
Connect Claude to Shopify with MCP and scoped access.
Custom GPT & Gems migration guide
Move custom GPTs to plugins and Gems to skills before the deadlines.
MCP vs API
How MCP and APIs fit together.
What is the Model Context Protocol?
MCP in plain terms.
ROAM Luggage case study
Agentic Shopify management with Claude and MCP.
Agentic Shopify management
Site changes by agents, published by people.