An MCP Server is a service that exposes tools, resources and prompts to an AI model through the Model Context Protocol. It is the component that lets AI perform concrete actions - read a database, send an email, update an ERP - without a custom integration for every single service.
If the Model Context Protocol is new to you, the complete guide to MCP covers the context and the overall architecture. This page focuses specifically on the Server component.
What an MCP Server is
In the MCP architecture, the Server is the node that "knows" a specific system. The GitHub Server knows repositories, commits and pull requests. The PostgreSQL Server knows the database and how to run queries. A company ERP Server knows orders, stock and invoices.
Each MCP Server registers with an MCP Host (the AI application) through an MCP Client, declaring its capabilities: which Tools it can execute, which Resources it can provide, which Prompt templates it has available. The AI model discovers those capabilities dynamically and uses them when relevant.
The key difference from an ordinary API: with a traditional API the developer has to know in advance what to call and how. With an MCP Server the AI model discovers the capabilities on its own and decides when and how to use them based on context.
How an MCP Server works
The JSON-RPC communication cycle
Communication between MCP Client and MCP Server runs over JSON-RPC 2.0, a lightweight JSON-based protocol. The typical flow is:
- The Client sends an initialize request to the Server, which responds with its capabilities
- The Client passes the list of available Tools, Resources and Prompts to the AI model
- When the AI decides to use a Tool, the Client sends a tools/call request to the Server
- The Server executes the operation and returns the result
- The result is added to the AI's context for the next step
Supported transports (stdio, SSE, WebSocket)
MCP supports three transport modes:
- stdio: communication over standard input/output. Ideal for local servers running on the same machine as the Host (for example Claude Desktop with local servers).
- SSE (Server-Sent Events): one-way HTTP communication. Suited to remote servers in cloud or enterprise scenarios with a stable connection.
- WebSocket: full-duplex two-way communication. Best for applications that need real-time updates.
What an MCP Server exposes
Tools (executable functions)
Tools are the actions the AI can perform through the Server. They have effects: they change data, send communications, create records. Every Tool has a name, a description (which the AI uses to decide when to call it) and a JSON schema defining the required parameters.
Typical Tools in an ERP MCP Server:
create_order- creates a purchase orderupdate_stock- updates an item's stock levelsend_confirmation_email- sends the confirmation email to the supplierget_product_availability- checks whether a product is available
Resources (readable data)
Resources provide read-only access to structured data. They have no side effects. They are used to enrich the AI's context before it makes decisions or generates answers.
Example Resources:
customer/{id}/orders- a customer's order historyproduct/{sku}/details- details and pricing for a productinvoice/{id}/status- the status of an invoice
Prompts (reusable templates)
Prompt templates are prepackaged instructions for recurring scenarios. They optimise how the model approaches specific tasks, embedding the best practices for that context. A "process delivery note" prompt might include instructions on handling mandatory fields, the most common exceptions and the expected output format.
Most used MCP Servers (curated list)
The MCP ecosystem already includes dozens of ready-to-use servers. These are the most widely adopted:
| Server | What it does | Transport |
|---|---|---|
| GitHub | Repos, PRs, issues, code review | stdio |
| PostgreSQL | SQL queries, schema inspection, data reads | stdio |
| Filesystem | Reading and writing local files with sandboxing | stdio |
| Slack | Sending messages, reading channels, workspace management | stdio |
| Brave Search | Real-time web and local search | stdio |
| Puppeteer | Browser automation, screenshots, scraping | stdio |
| Memory | Persistent knowledge graph for the AI | stdio |
| Google Drive | Access to documents, Sheets, Docs | stdio |
How to build an MCP Server
In Python (with the mcp SDK)
The quickest way to build an MCP Server is with the official Python SDK. Here is a minimal example of a server with a single Tool:
from mcp.server import Server
from mcp.server.stdio import stdio_server
from mcp.types import Tool, TextContent
import json
server = Server("erp-connector")
@server.list_tools()
async def list_tools():
return [
Tool(
name="get_order_status",
description="Retrieve the status of an ERP order",
inputSchema={
"type": "object",
"properties": {
"order_id": {
"type": "string",
"description": "ID of the order to check"
}
},
"required": ["order_id"]
}
)
]
@server.call_tool()
async def call_tool(name: str, arguments: dict):
if name == "get_order_status":
order_id = arguments["order_id"]
# Your ERP integration logic goes here
status = fetch_from_erp(order_id)
return [TextContent(type="text", text=json.dumps(status))]
async def main():
async with stdio_server() as streams:
await server.run(*streams)
if __name__ == "__main__":
import asyncio
asyncio.run(main())In TypeScript
The SDK is also available for TypeScript/Node.js through the @modelcontextprotocol/sdk package. The structure mirrors the Python one: create a Server, register handlers for list_tools and call_tool, and configure the transport.
Deploying it (local vs remote)
For local use (development, or a personal Claude Desktop setup) the server runs as a stdio process configured in claude_desktop_config.json. For remote use in enterprise environments, the server is deployed as an HTTP service with SSE transport, protected by authentication and reachable over the corporate network.
MCP Servers and security
Authentication
Every request to the Server should be authenticated. For local servers, trust comes from the user's session. For remote servers you need API tokens, OAuth or client certificates. The MCP Host should never pass the user's credentials to the Server without explicit consent.
Sandboxing operations
Tools with irreversible effects (deleting data, sending bulk email, moving money) should require explicit user confirmation before running. The "Human-in-the-Loop" pattern - where the AI proposes the action and the user approves it - is essential for high-impact operations.
Audit logging
Every Tool call should produce a structured log entry: timestamp, user, Tool invoked, parameters, result. That audit trail is essential for debugging, compliance and post-incident analysis in a business context.
When a company needs a custom MCP Server
A custom MCP Server is needed when you want to connect AI to proprietary systems that existing open-source servers do not cover: company ERPs, vertical management software, legacy databases, internal ticketing systems or production platforms.
The signals that you need a custom server: AI agents must reach real-time data in the ERP; you want to automate document flows spanning several business systems; or you want agents that act autonomously on repetitive operational processes.
Frequently asked questions about MCP Servers
What is an MCP Server?
An MCP Server is a service that exposes tools, resources and templates to an AI model through the Model Context Protocol. It lets the AI perform concrete actions such as reading a database, sending an email or updating an ERP without custom integrations.
Which MCP Servers are most widely used?
The most used MCP servers: GitHub (repositories and PRs), PostgreSQL (SQL queries), Filesystem (local files), Slack (messages), Brave Search (web search), Puppeteer (browser automation).
How do you build a custom MCP Server?
Using the official MCP SDK in Python or TypeScript. You define Tools, Resources and Prompts, configure the transport and expose the server to the host AI application.
What is the difference between a Tool, a Resource and a Prompt in an MCP Server?
Tools are executable functions with effects (creating records, sending emails). Resources are read-only data sources (order history, prices). Prompts are predefined templates for recurring scenarios.
Is a custom MCP Server for a company ERP secure?
Yes, if implemented properly. Security practices include authentication on every request, granular permissions for Tools and Resources, sandboxing of destructive operations, an audit log of every call, and never exposing credentials in the code.
MCP Servers and TypeLens: a real case
The TypeLens Workflow Builder uses MCP Servers to connect its document extraction AI to the main Italian ERPs (SAP, TeamSystem, Odoo, eSolver, Ad Hoc). Each connector is implemented as an MCP Server exposing Tools for creating warehouse movements, orders and invoices, and Resources for checking items and suppliers.
The result: a delivery note arrives by email, the AI processes it, checks the item in the ERP through a Resource, and creates the warehouse movement through a Tool - with no manual step for standard cases. To go deeper on delivery note automation see the complete guide to DDT automation →
To understand the protocol as a whole, go back to the Model Context Protocol guide →