MCP or API: how AI agents reach your ERP
By Philipp Kant 5 min read
The Model Context Protocol (MCP) is an open standard that lets an AI agent use the tools and data of other systems: the agent asks an MCP server which tools exist and calls them. For an ERP that means looking up records, pulling reports, and, where permitted, creating transactions, without a custom interface for every agent.
Anthropic introduced MCP in November 2024 and handed it to the Agentic AI Foundation under the Linux Foundation in December 2025. OpenAI, Google, and Microsoft support it. Since 2026 the ERP vendors ship their own MCP servers.
MCP does not replace the API, it sits on top
An API is a system’s interface: fixed endpoints, fixed fields, documented for developers. An MCP server describes the same functions so that a language model can find them and call them correctly, with names, descriptions, and parameters the model reads at runtime.
| API integration | MCP server | |
|---|---|---|
| Who calls it | Code a developer wrote | An agent deciding at runtime |
| Flow | Fixed: the same steps every run | Open: the agent picks tools per task |
| Connection | Built per system and per application | Once per system, for every MCP-capable agent |
| Strength | Predictable, cheap, easy to test | Flexible lookups, new questions without new code |
| Approvals | In your own code | Not in the protocol, they belong in the harness |
Most ERP MCP servers are built on the vendor’s API. MCP adds one standard way for any agent to reach it. A clean API integration loses nothing: the same functions can also be handed to an agent.
Which ERPs have an MCP server
As of October 29, 2026, six ERP vendors offered their own MCP server (overview by Loopfour):
| ERP | MCP server | Writes |
|---|---|---|
| Microsoft Dynamics 365 Finance and Supply Chain | Dynamics 365 ERP MCP | Follow the user’s role |
| Microsoft Dynamics 365 Business Central | vendor-built | An admin must unblock edits |
| Oracle NetSuite | AI Connector Service | Follow the user’s role |
| QuickBooks Online | vendor-built | On by default |
| Xero | vendor-built | not stated |
| Sage Intacct | via the AI Gateway | not stated |
SAP S/4HANA has no server of its own on that list. Its data is reachable through the AWS for SAP MCP Server or through servers generated in SAP Joule Studio. SAP Integration Suite also provides an MCP gateway that exposes existing APIs and integration flows as MCP tools.
What an ERP MCP server does: Dynamics 365
Microsoft documents its server for Finance and Supply Chain Management in detail (Microsoft Learn). It offers three kinds of tools:
- Data tools: read, create, update, and delete records through data entities.
- Form tools: open forms, set fields, press buttons, the way a person works in the UI, but through server APIs.
- Action tools: call custom business logic that developers exposed as an AI tool.
The agent only sees what its security role allows. With a purchasing agent’s role, it finds only that role’s menus, data, and actions. Microsoft announced the retirement of the older version with 13 fixed tools for October 1, 2026. Tool calls from agents outside Copilot Studio cost 0.1 Copilot Credits each, on top of the model’s cost.
When the API is the better route
MCP sounds like the new standard for everything. For many processes it is not.
- Fixed processes: an order arrives, gets checked, and is created in the ERP, the same way every time. That is an integration with fixed steps. An agent that rethinks its tool choice on every run is slower, costlier, and harder to test here.
- Volume: reconciling ten thousand items overnight is a job for an API or an import, not for ten thousand agent decisions.
- Strict approvals: MCP has no approval step of its own. Writing to the general ledger needs an approval outside the chat, in your code or your workflow.
In practice we combine both. The fixed part of a process runs over the API. The agent takes the part that needs judgment: reading an unclear order, looking up a missing value, explaining a mismatch. For that it uses MCP tools with read access, and every writing step goes through a check. What that looks like is in AI agent, RPA, or workflow.
How secure MCP is for ERP data
MCP is young, and it shows. In 2025, attacks through manipulated tool descriptions (tool poisoning) became known, along with flaws in widely used helper tools. The specification now requires OAuth 2.1 and forbids passing tokens through. The July 28, 2026 revision made the protocol stateless. In May 2026 the NSA wrote that MCP’s spread had outpaced its security model.
For an ERP that means:
- Only MCP servers from the vendor or from your own code, never arbitrary servers from the internet.
- A separate identity for the agent, with the smallest role the task needs.
- Writing tools only where a check follows.
- Every tool call logged.
These are rules for the agent’s harness, not for the prompt.
FAQ
Do we need MCP to use AI agents? No. An agent can call any API through its own tools. MCP saves work when several agents or applications use the same systems, and it is the route the ERP vendors now offer themselves.
Does our ERP have an MCP server? Dynamics 365, Business Central, NetSuite, QuickBooks Online, Xero, and Sage Intacct do (as of October 2026). SAP through Integration Suite or AWS. For other systems, a lean server can be built on the existing API.
Can an agent change ERP data through MCP? Yes, if the server offers writing tools and the agent’s role allows it. Whether it may do so without a check is decided by your harness, not the server.
What does a custom MCP server cost? For a system with a documented API and a few clearly cut tools, it is a project of days, not months. The bigger part is usually deciding which data the agent may see.
Whether your website is already built for agents shows in the free AI Agent Readiness Check. An AI agent that works in your ERP over API and MCP is what we build, at a fixed price.
Ask an AI about this post
