Make your business system operable by AI: lessons from hundreds of MCP tools in production

01

What "operable by AI" means for an owner

A person on your team signs in from Claude with their own account and asks for a list, a change or a report in plain language. The answer comes from your system's live data, not from a copy. Three pieces make that work:

• Your system: the database, the admin panel, the business rules.
• An MCP server: a small service that describes your system's actions as tools, each with a name, a description written for the model, and its inputs.
• An AI client: Claude or ChatGPT. It reads the descriptions, picks a tool and calls it.

In our server, "new leads from this week" becomes a call to list_leads, "move this one to proposal" becomes update_h2m_lead_stage, and "has she opened the offer yet?" becomes list_offer_views. Before a tool runs, Claude asks the person to approve the call, unless they chose "Allow always" for that tool.

Adcare runs the same pattern for an agency and its clinics. Its system is one codebase: a multi-tenant CMS with every clinic on its own tenant, an agency CRM and a per-clinic CRM, 66 tables. On top sits an MCP server with 180 tools, and the agency operates content, leads, follow-ups and reports from Claude. The per-seat subscription it used before is gone (Adcare case).

MCP or a plain API? An API is for programs your developers write. An MCP server describes the same actions in words a model can read, and in our setup each person signs in with their own account. If two systems only sync orders every night, an API is enough. MCP earns its place when people ask questions no report was built to answer.

Is it a safe standard to build on? MCP is no longer one vendor's format. On 9 December 2025 Anthropic donated it to the Agentic AI Foundation, a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI. Anthropic then counted more than 10,000 active public MCP servers and over 97 million monthly SDK downloads, with ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code among the adopters (Anthropic). One server can serve several AI clients.

When it does not pay off:

• Your data lives in SaaS products that already ship their own connector. Use theirs.
• Fewer than three people would use it, a few times a week (our rule of thumb). Keep exporting to a spreadsheet.
• You have no system of your own. With us one starts at PLN 60,000, and building it only so that AI can reach it rarely pays back. Build it for other reasons first (subscriptions you drop, a process that fits); MCP is then a small add-on.

02

Read tools vs write tools

Reading is cheap and mostly harmless. Writing changes your business. Treat them as two products. Our server sorts its 217 tools by name. A tool whose name starts with list_, get_, search_ or describe_, or ends in _stats, is a read; six more reads are listed by name. Everything else is a write. By that rule we have 65 reads and 152 writes.

The guards hang off that rule. Each person gets 120 tool calls a minute; writes also draw on a second budget of 60 a minute. A runaway loop hits that wall before it floods the database, and each refusal is written to the audit log. One caveat from Cloudflare, whose limiter we use: it is "permissive, eventually consistent", and each Cloudflare location keeps its own count (Cloudflare). It stops loops. It is not an accounting control.

The rule is crude, and it fails in the safe direction. Judging by their descriptions, at least 16 of the 152 "writes" only read, such as analytics_summary or sla_status, and get the stricter limit. We accept that. A write passing as a read is the mistake that hurts.

The chart splits the 217 tools by area (source files grouped as in the note), counted on 25 September 2026 with the name rule. The client panel's writes are mostly real: quotes, invoices, milestones, training sessions. Three of its 42 (sla_status, panel_project_status, vault_list) only read.

Three rules for writes, all visible in the code:

1. Bulk reads count as writes. export_leads only reads, but it hands over every lead at once. It takes the write limit and is logged as an export.
2. Personal data is deleted softly, with a reason. delete_lead marks the lead as deleted, and restore_lead undoes it. It will not run without a reason, and the reason goes to the audit log because GDPR asks for it. Webinar sign-ups follow the same rule. Permanent erasure lives only in the admin panel, for the superadmin.
3. Roles decide which tools exist. A manager signing in from Claude gets 59 tools: pages, media, webinars, campaigns, templates, analytics. An admin gets all 217. The 12 user-administration tools refuse to run for anyone but the superadmin. A tool a person cannot see is a tool Claude cannot misuse on their behalf.

The gap. Outside personal data we were less strict. When we counted for this article, ten tools callable from Claude could still remove a record for good, five of them for managers too: files (hard_delete_media), pages, campaigns and their steps, offer drafts and slides, portfolio items, lead tasks, lead contact people and client documents. Some have guards: delete_campaign refuses a campaign with send history unless told force=true, and delete_offer_draft removes drafts only. None asks for a reason. You only find this kind of gap by counting.

03

The audit log is the product

A month after launch, the owner's question is no longer "can Claude do it?" but "who changed this, and was it Claude?". If you cannot answer in a minute, nobody will allow write tools, and the server shrinks to a search box.

One row in our audit_log holds:

• who: the user account, since every person signs in separately;
• where from: admin panel, MCP, API or system;
• what: the action (create, update, delete, publish, export and a few more), the record and a one-line summary;
• the diff: changed fields, before and after;
• for MCP calls: the tool name and, where passed, its input.

The admin panel and the MCP server write to the same table. The admin's audit screen filters by person and source, so a person's clicks and Claude calls sit in one list.

Three design choices, and what each costs:

• Large fields are logged as sizes, not contents. When a page's sections change, the row records that the list changed length, not the new text. The table stays small, but an edit that keeps the number of sections shows up with no changed field, and a deleted page cannot be rebuilt from its audit row. Where wording matters, keep version history; our offers and media files have it, with restore tools.
• The log never blocks the change. If the audit insert fails, the change still goes through and the error goes to the server log. Right for page edits; for money and permissions you may want the opposite rule: no audit row, no change.
• Refused calls are logged too. A burst of rate-limit refusals points to a looping agent or a stolen token, which is what the limit is there to catch.

Now the honest part. The tool files call the audit log in 76 places, while 152 tools count as writes. Part of that gap is harmless: at least 16 of those "writes" only read. Client-panel changes go to a separate panel_audit table, the history the client sees, and offers keep their own event history. Three trails, not one: "who changed this?" can mean three queries. If you start today: one log, one format, from the first write tool.

04

Too many tools

More tools do not make a better assistant. In the basic setup, every tool's name, description and input schema enters the model's context before the first question. In Anthropic's example, 58 tools from five common servers take about 55,000 tokens, and at Anthropic tool definitions have reached 134,000 tokens before optimisation. It recommends its tool search feature when definitions pass 10,000 tokens or there are 10 or more tools. In internal testing on MCP evaluations, tool search raised accuracy from 49% to 74% for Opus 4 and from 79.5% to 88.1% for Opus 4.5 (Anthropic Engineering).

By the rough rule of four characters per token, that is about 35,000 tokens, three and a half times Anthropic's threshold (our estimate, not a token count). Tool search is a setting of the AI client or the API. On the server you control how many tools you expose and how many words each one costs.

What helps, in the order we would do it again:

1. Role-based sets. The manager's 59 tools come to about 44,000 characters, under a third of the admin's list, and managers never needed the rest.
2. Prefixes that group tools. vsl_ for the video funnel, an _h2m_ infix for our own sales meetings so the model does not confuse them with a client's. Anthropic recommends the same namespacing (Anthropic Engineering).
3. Descriptions that say what a tool does not do. mark_offer_won states that it does not move the lead's stage; that is a separate tool, and the sentence stops the model from assuming one call does both.
4. Fewer, larger tools. Anthropic's example is one schedule_event instead of list_users, list_events and create_event (Anthropic Engineering). We have not done enough of this. Our five lead-task tools (list, create, complete, reopen, delete) could be two.

Decision rule: start with the ten questions and five changes your team asks for most. Add a tool when the same request comes up twice in a week and no tool covers it. Remove a write tool that nobody has called in a month; the audit log shows which writes are in use, provided every write logs.

05

Claude vs ChatGPT connectors

Both can use your MCP server. The differences, as of 25 September 2026:

Claude (Claude Help Center, updated 11 August 2026):

• Custom connectors over remote MCP work in Claude, Cowork and Claude Desktop on Free (one connector), Pro, Max, Team and Enterprise plans.
• On Team and Enterprise only Owners add a connector; each person then connects individually, which fits per-person accounts on your server.
• Claude connects from Anthropic's cloud, not from your laptop, so your server must be reachable from the public internet.
• Tool calls ask for approval. The help centre advises "Allow always" only for a server and tool "that you trust to run unsupervised".

ChatGPT (OpenAI developer docs):

• Developer mode, on the web, for Plus, Pro, Business, Enterprise and Education accounts.
• Full MCP support for read and write tools; writes require confirmation by default.
• A tool without the readOnlyHint annotation is treated as a write.
• OpenAI labels developer mode "elevated risk", naming prompt injection, "model mistakes on write actions that could destroy data" and malicious servers.

Our own server is used today from Claude on the web and desktop, and from Claude Code. Two things in the code stand between it and ChatGPT:

• Sign-in accepts only redirect addresses on claude.ai and claude.com. A ChatGPT connector would be refused until its host is added.
• None of our 217 tools carries readOnlyHint. In ChatGPT, even "list this week's leads" would ask for confirmation.

Both are small changes. That is why our modules page says ChatGPT and other MCP clients are "checked per install".

Decision rule: build one server and connect the client your team already pays for. If your people are split between Claude and ChatGPT, mark every read tool read-only before launch, or ChatGPT users learn to click "confirm" without reading and the gate stops working.

06

What it costs to add to your system

Prices are net of VAT, as of 25 September 2026.

1. H2M already maintains your system on a monthly plan. Our SLA treats installing a module as a large change in your queue, or quotes it separately. On the Tor plan (PLN 8,900 or EUR 2,090 a month) a large change is ready for your review within 7 business days of its start.
2. You have your own system, built by someone else. The module is quoted after the free 30-minute call. Our current internal range is PLN 8,000-25,000 to build plus PLN 500-1,500 a month to keep it updated: an estimate, not a price list. If the code needs a proper review first, that is our audit: PLN 5,000, deducted from the build if you go ahead.
3. Everything you run is SaaS. Look for the vendor's own connector first. An own system starts at PLN 60,000 and pays back through the subscriptions you drop and the process fit, not through AI access alone.

Hosting is small next to that: Cloudflare's Workers Paid plan has a minimum of USD 5 per account per month, with 10 million requests and 30 million CPU milliseconds included (Cloudflare). Add the Claude or ChatGPT seats your team already has.

A worked example. Assumptions: build PLN 16,500 and upkeep PLN 1,000 a month (the middle of each range), an office hour costs PLN 100, a month has 4.33 weeks. The unknown is hours saved per week across the team: lookups in the admin, copying between tools, rebuilding the same report.

• 2 hours a week saves PLN 866 a month, less than the upkeep. It never pays back. Do not buy.
• 5 hours a week saves PLN 2,165, or PLN 1,165 a month net. It pays back in about 14 months.
• 10 hours a week saves PLN 4,330, or PLN 3,330 net. It pays back in about 5 months.

Decision rule: hours saved per week × hourly cost × 4.33, minus the monthly fee, times 12, should be more than the build cost. That is a one-year payback. In the example only the 10-hour case passes; the 5-hour case falls short by about PLN 2,500 (12 × 1,165 = 13,980 against 16,500). If the sum only works at the top of your estimate, wait.

07

Adding MCP to your system in 4 steps

1. Collect a week of requests: every question about the CRM, offers or pages, every change people ask someone else to make.
2. Ship reads first, with per-person sign-in and roles.
3. Put writes behind the gate: rate limit, an audit row for every write, soft deletes with a reason, no permanent deletes from AI.
4. Review the log monthly: drop unused writes, merge tools always called together, mark reads read-only before adding ChatGPT.

How an engagement runs is on the process page; what the MCP module includes today is on the modules page.

08

Sources

1. Anthropic, "Donating the Model Context Protocol and establishing the Agentic AI Foundation", 9 December 2025. https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation (accessed 25 September 2026)
2. Claude Help Center, "Get started with custom connectors using remote MCP", updated 11 August 2026. https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp (accessed 25 September 2026)
3. OpenAI, "Developer mode" (ChatGPT developer mode guide). https://developers.openai.com/api/docs/guides/developer-mode (accessed 25 September 2026)
4. Anthropic Engineering, "Introducing advanced tool use on the Claude Developer Platform", 24 November 2025. https://www.anthropic.com/engineering/advanced-tool-use (accessed 25 September 2026)
5. Anthropic Engineering, "Writing effective tools for agents - with agents", 11 September 2025. https://www.anthropic.com/engineering/writing-tools-for-agents (accessed 25 September 2026)
6. Cloudflare, "Workers pricing". https://developers.cloudflare.com/workers/platform/pricing/ (accessed 25 September 2026)
7. Cloudflare, "Rate Limiting" (Workers runtime API). https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/ (accessed 25 September 2026)
8. H2M, "Adcare: A clinic marketing operating system, operated from Claude". https://h2mai.com/work/adcare (accessed 25 September 2026)
9. H2M, "Modules". https://h2mai.com/modules (accessed 25 September 2026)

09

How this was written

The H2M numbers come from the source code of H2M's own MCP server on 25 September 2026: tool registrations counted in the source, reads and writes sorted with the server's own rule, the tool list measured through the MCP SDK, and limits, roles, deletes and the audit format read from its configuration and code. Adcare figures are only those already public on its case page, and no other client is named or described. The text was drafted with AI assistance, then edited and fact-checked against the sources above. Prices, plans and product features are as of 25 September 2026 and will change.