Every App Answers Directly

Give each system already running in the business a path built for questions, so anyone asks in plain writing instead of opening a screen and filtering by hand.

A maintenance planner answers nine questions this way, seven at launch and two added later: who has an appointment on the 31st is one sentence. A bookkeeping system covers money in and out, what is owed, receipts, revenue per customer and invoicing. A media library was connected the same way, with thirteen things it can do. Every answer comes from the live system, shaped for the question.

Every Write Waits for a Person to Submit It

Answer with a prefilled form on screen, laid out in the fields the application already uses, with the account it suggests drawn from how similar items were booked before. The assistant holds no ability to save.

Posting is a separate step, taken by the person looking at the form, so a wrong suggestion is corrected on screen. The whole exchange runs behind the login the application already uses: no new account, and no sight of anything the person could not already open.

Asked in the Office's Own Words, From Any Device

Write the instructions that tell the assistant what each system does in German, in the words the business itself uses, so a question is asked the way somebody would ask it in the office and a name typed differently from last time still returns the right person.

Access runs through the browser from a phone as well as a desk, with no separate app. On a managed Windows machine the configuration file goes at a particular place in the user profile, which is documented. The switch that turns the assistant on sits in the application’s own settings.

9
schedule tools on the maintenance-planner MCP endpoint, seven at launch
OAuth 2.1
with RFC 9728 protected resource metadata on the endpoint
13
tools on the media MCP server, HTTP and MCP side by side
0
write tools the model holds in the confirmed-action flow

The Custom MCP Server Playbook

Turn the System Into Tools 3 steps
01

Start From the Questions People Keep Asking

List the questions the office asks the system, then build one tool per question. The maintenance-planning API serves an MCP endpoint at /mcp with seven schedule tools: by date, by week, by employee, objects serviced by an employee, free slots for an object, and lookup for employees and houses. Each one answers from the live database.
02

Write the Tool Descriptions in the Office's Own Words

Write each tool description in the working language of the office, Termin, Einteilung and Wartungsplan, so the model picks the right tool without coaching. Resolve employee and house names fuzzily, so a name typed the way staff say it finds the record. Treat the descriptions as prompt engineering and revise them against real questions.
03

Build Tools on Dedicated Query Services

Build each tool on a query service written for the question, rather than on the controllers the screens use. The bookkeeping API exposes finance, liquidity and contact revenue tools this way, with voucher tools and invoicing tools for invoice creation and PDF delivery on MCP SDK 2.1.0. Sharpen overlapping wording between tools, which is what decides disambiguation.
Protect the Endpoint 3 steps
04

Protect the Endpoint With OAuth 2.1

Protect the /mcp endpoint with OAuth 2.1 and RFC 9728 protected resource metadata, and register a static API key handler as a second scheme beside the Microsoft Entra ID JWT scheme. Browser clients complete the OAuth flow; desktop and command-line clients use the key.
05

AADSTS9010010 Solved With a Verified Custom Domain

Microsoft Entra ID resource-parameter enforcement stops the authorization handshake with AADSTS9010010, on official Microsoft MCP servers as well. Front the API with a verified custom domain, add a matching second App ID URI, and accept both audiences. The diagnosis is documented, so the next endpoint applies the fix directly.
06

The 401 Challenge Advertised Over HTTPS Behind a Proxy

Behind a shared reverse proxy the 401 challenge advertises its protected resource metadata over http, because the proxy drops the scheme, and no client finishes the OAuth flow. Honour X-Forwarded-Proto so the challenge carries https. Check this first once an endpoint leaves a developer machine, since a TLS-terminating proxy is the default on a shared box.
Keep the Write Under Human Control 2 steps
07

Return a Prefilled Form for a Person to Submit

Have the drafting tool return an interactive ui://vouchers/add-voucher-form resource that the chat client renders as a real form, prefilled with what the model proposed. Give the model no write tool at all: save_voucher is the only write path, and it runs when the person looking at the form triggers it.
08

Same Code, Same Data, One Switch

Host the MCP surface in the same ASP.NET Core 10 API and EF Core 10 model against SQL Server that the application uses, with Microsoft Entra ID and MSAL for sign-in and JWT validation. Put an MCP toggle in the settings area beside AI model management and the blob storage browser, so an administrator switches the surface off in one place.
Ship It Where the Work Happens 2 steps
09

Desktop, Web and iPad, Plus a Slot to Test On

Make the tools reachable from the Claude desktop app, Claude on the web and Claude on mobile, and document the API key connection path including the Windows MSIX config-file location and the mcp-remote bridge. In August 2026 the planner MCP server was aligned for the blue staging slot and two more schedule query tools were added, so the endpoint is exercised before a release.
10

Expose the Same Capability Twice

Expose the service over HTTP for what a person clicks and over MCP for what a model calls, as the media server does across 13 tools covering generation, screen capture, the asset library and model management. Run cross-application calls over REST and MCP at runtime, and give each database and each write-once asset root exactly one owning process.

Frequently Asked Questions

What kind of system can be exposed as an MCP server?
Anything that can be hosted securely and already has an API. Delivered so far: a maintenance planner database, a bookkeeping ledger, a media service, and the tooling inventory itself. The MCP endpoint sits on the same code and the same data as the application, and tools are built on dedicated query services rather than on screen endpoints.
How is the endpoint protected?
By OAuth 2.1 with RFC 9728 protected resource metadata, backed by Microsoft Entra ID, with a static API key handler registered as a second scheme beside the JWT one. Browser clients complete the OAuth flow; desktop and command-line clients use the key. Two known blockers are solved and documented: Entra ID resource-parameter enforcement (AADSTS9010010) and a reverse proxy dropping the https scheme from the authentication challenge.
Can the model change data, or is it read only?
It proposes a change and a person makes it. A drafting tool returns an interactive form resource that the chat client renders as a real form, prefilled with what the model proposed, and the model itself has no write tool. A separate save path performs the only write, triggered by the person looking at the form.
Where can the tools actually be used?
From the Claude desktop app, Claude on the web and Claude on mobile. The desktop connection path over the API key scheme is documented, including the Windows MSIX config-file location and the mcp-remote bridge. Endpoints are also aligned for a staging slot, so tools are exercised before a release reaches real users, and an administrator can switch the MCP surface off from the settings area.