Should your SaaS ship an MCP server? A founder's guide to the Model Context Protocol

A year ago, the Model Context Protocol (MCP) was an interesting open standard. In 2026 it is infrastructure. The protocol is now governed under the Linux Foundation's Agentic AI Foundation, its SDKs are downloaded tens of millions of times a month, and every major AI assistant can connect to MCP servers.

For SaaS founders the question has moved from "what is MCP?" to "do our customers' agents need to use our product?"

What MCP actually gives you

MCP standardises how an AI client discovers and calls capabilities in your product:

• Tools: actions the model can take, such as create_invoice or search_tickets
• Resources: data the model can read, such as a project or a document
• Prompts: reusable templates your product offers to the user

Instead of building a custom plugin for each assistant, you ship one server. The official specification and SDKs cover TypeScript, Python and most other mainstream languages.

When an MCP server is worth building

Build one if at least two of these are true:

1. Your users already paste your product's data into ChatGPT or Claude
2. Your product holds actions an assistant could take (create, update, schedule, approve), not just static content
3. Customers or prospects ask "does it work with our AI tools?" in sales calls
4. You already have a stable public API

Skip it, for now, if your product is mostly read-only marketing content (structured data and good SEO matter more; see SEO for AI search) or your API is still changing every week.

Design tools for tasks, not endpoints

The Thoughtworks Technology Radar has warned against naive API-to-MCP conversion, and we agree. Agents perform worse when they get 60 near-identical tools.

Good MCP tools:

• Map to user intents: schedule_meeting(attendees, window) rather than POST /events plus GET /availability
• Have descriptions written for a model: when to use the tool, when not to, and an example
• Return compact, structured results, not 400-field JSON dumps
• Fail with actionable errors, for example "date must be in the future; the user's timezone is Europe/London"

Token efficiency matters. Cloudflare reported that letting models write code against an API (its "Code Mode" approach) cut tool-definition tokens by around 94% compared with loading every tool upfront. Even if you don't adopt that pattern, fewer and better tools is the lesson.

Authentication and tenancy

Remote MCP servers should follow the protocol's authorisation specification, which builds on OAuth 2.1:

• Each user grants access through your normal login, including SSO and passkeys
• Tokens carry scopes (read-only versus write) and are tied to a tenant
• Admins can see and revoke connected agents

Recent spec revisions have moved the transport towards stateless, plain-HTTP operation, which makes MCP servers much easier to run on serverless platforms and behind your existing load balancers.

Security: assume the caller is confused

The model calling your tool may have read a malicious email five minutes earlier. Design for that:

• Require confirmation for destructive or financial actions, and return a preview first
• Rate limit per user and per tool
• Log every call with the client name, user, arguments and result
• Never return secrets or other tenants' data, even in error messages

Our prompt injection defence guide covers the threat model in depth.

Measure it like a product

Track:

• Connected clients and active users per week
• Tool success and error rates
• Which tasks agents perform most (often a strong signal for your roadmap)
• Support tickets that mention AI assistants

Large platforms are already seeing millions of MCP calls a month. Even at startup scale, usage data tells you which workflows customers want to automate.

A two-to-four-week plan

Week	Deliverable
1	Pick the 5–10 highest-value tasks; design tool schemas and descriptions
2	Build the server on your existing API; add OAuth and scopes
3	Evals: run real tasks through two or three AI clients and fix the tool designs
4	Rate limits, audit logs, docs page and launch

Bottom line

If customers use AI assistants to do their jobs, an MCP server is quickly becoming as expected as a public API. The work is less about the protocol and more about designing a small set of safe, task-level tools.

Want help scoping it? Our custom software and AI integration team ships MCP servers in sprint-sized increments. Start with a call.