How to Connect an AI Agent to Company Systems

“We want an AI agent to update Jira tickets and read documents from SharePoint on its own. How do we connect it?” The connection method is often treated as a technical detail for the team to settle. Yet it determines how much the integration costs to maintain, who can call it and whether after an incident you can reconstruct exactly what the agent did. This applies to every system holding data: Jira, SharePoint, a data warehouse, an ERP system (enterprise resource planning) or an internal API (application programming interface).

Two ways to connect a tool

MCP standardizes how capabilities are described, how permissions are negotiated and how results are passed. A script leaves those decisions to the team, which is an advantage with one integration and a problem with ten.

State of the protocol in July 2026

On 9 December 2025 MCP moved to the Agentic AI Foundation, a fund run under the Linux Foundation and co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg. The announcement cited more than 10,000 active MCP servers and more than 97 million monthly SDK downloads.¹ A public server registry has been running since September 2025.

The current specification is dated 2025-11-25, but the shape of the next one is already fixed. On 21 May 2026 a release candidate for version 2026-07-28 was published, with the final version scheduled for 28 July. It is the largest change since the protocol launched: a stateless core without session negotiation, capability negotiation per request, tightened authorization rules and an extensions framework.² The changes break backward compatibility, so an integration written today for version 2025-11-25 needs a review before its libraries move to the new specification.

When MCP pays off

1. The same tool called from several places. One server serves an assistant in the code editor, a chat app and your own agent instead of three separate integrations maintained by three people.
2. The system vendor maintains the server. Compatibility with successive API versions stops being the team’s cost and becomes part of a product the vendor is responsible for.
3. Per-user permissions. When access is granted to each person separately, with token refresh and revocation, the protocol’s authorization layer does work that would otherwise be written by hand.
4. A changing set of tools. When the catalog of functions changes every few weeks, discovering tools at runtime is more convenient than updating prompts with every change.

When a script is enough

For one integration called from one place, an MCP server adds a layer that returns nothing. If the repository already holds a tested script for issuing invoices or updating tickets, letting the agent call it is cheaper than rewriting it for the protocol.

A script also wins on high-stakes operations, where a narrow and rigid surface matters. Five explicitly defined commands are easier to review in code review than a server with forty tools the agent chooses from on its own.

A split between reading and writing also works well. Reading data goes through the vendor’s ready MCP server, because it is convenient and does not change the system’s state. Every write goes through your own script, with the credential in environment variables and a log of every call. The company then maintains two mechanisms instead of one, and in return every state-changing operation has an explicit path and leaves a trace.

The cost of context

Tool definitions take up space in the model’s context. With a dozen or so connected servers the catalog alone can take tens of thousands of tokens before the agent does anything. In November 2025 Anthropic described a pattern for calling MCP tools from code run in an isolated environment: definitions loaded on demand, intermediate data processed in code and only the finished result passed to the model. In the example described, the task dropped from about 150,000 to about 2,000 tokens.³ It is one documented case, so the numbers do not transfer directly to other environments, but the direction is clear: MCP provides the tool description, and execution ends up in code anyway.

• c. 150,000tokens in the example task when definitions and intermediate data pass through the model context
• c. 2,000tokens for the same task when code calls the tools and the model receives the finished result

Security and the audit trail

On 15 April 2026 researchers described a class of attacks called “Comment and Control”.⁴ Content injected into a pull request title or an issue comment took over agents run automatically in GitHub Actions, including Claude Code Security Review, Gemini CLI Action and GitHub Copilot Agent, and led them to exfiltrate secrets from the runtime environment. The vendors paid bug bounties for the reports, without public CVE identifiers (the catalog of publicly known vulnerabilities).

An agent treats the content it reads as trusted context, so its permissions become the attacker’s permissions. The extent of the damage is limited by four controls applied together:

1. An allowlist of tools.
2. An identity attached to every call.
3. A log of the arguments and result of every call.
4. Human approval for irreversible operations.

In a conversation with auditors a script has the edge: the call log appears by itself and the permission boundary is visible directly in the code. With MCP the audit has to be designed deliberately, because the call passes through a layer the team did not write.

Four questions before choosing

The choice is made separately for each integration, with a short written rationale, because within a few months both the protocol versions and the list of ready servers maintained by vendors will change. We review agent integrations and design permissions as part of the AI Automations & Agents package.

Frequently asked questions