MCP for the CTO: letting AI safely “touch” your POS, inventory and CRM
For years the problem was the same: the model is smart, but isolated. It knows everything about the world and nothing about your inventory. Model Context Protocol (MCP) is the open protocol that ended that isolation in a…
For years the problem was the same: the model is smart, but isolated. It knows everything about the world and nothing about your inventory. Model Context Protocol (MCP) is the open protocol that ended that isolation in a standard way: instead of every team writing a “custom integration” per model, you write one MCP server that exposes your tools and data, and any capable client — Claude, Cursor, or your in-house agent — can use it.
The concept in three words: tools, resources, prompts
- Tools: actions the model can perform — “create an invoice”, “find a spare part by chassis number”.
- Resources: data the model reads — today’s sales report, the returns policy.
- Prompts: ready templates filled with business context — “summarise the branch’s weekly performance”.
A real example: the multi-tenant TtaKkaa panel
The TtaKkaa Admin Panel manages hundreds of stores, branches and subscriptions. On top of it we built an MCP server exposing a very small set of tools: read branch KPIs, open a support ticket, and suspend a subscription with human confirmation. The result: the operations manager asks in Arabic, “which branches dropped 20% this week and why?”, and gets an answer grounded in real data, not guesswork.
The golden rule: the server decides what is allowed, not the model
Do not expose “run SQL”. Expose “fetch branch sales by date”. That difference is the difference between a system and a security incident.
In AutoParts System (a huge spare-parts catalogue), the server exposes a tenant-scoped search and never a delete. Every tool carries a precise description, because the description is what the model reads to decide when to use it — a vague description means wrong usage.
The structure we recommend
- A domain layer that already exists in Laravel or NestJS — do not duplicate business logic inside the MCP server.
- A thin MCP server translating tools into domain-layer calls, with an authorisation check on every call.
- An audit log recording who asked for what, through which model, and the outcome.
- Switches on sensitive tools: anything that moves money or stock goes through human confirmation.
What about small shops?
The single-store Sanmoris system does not need ten servers. One MCP server with three tools — today’s sales, items about to run out, top ten customers — turns “AI” from a marketing word into an assistant that answers the owner on their phone every morning.
Bottom line
MCP does not make the model smarter; it makes it informed and governed. That is exactly what any serious business needs before trusting an agent to act in its name.
