MCP server development
Your internal systems, reachable from the AI tools your team already uses — through the Model Context Protocol, with authentication, per-user permissions, an audit trail and a written residency boundary.
The protocol
is the easy part.
The Model Context Protocol is an open standard for exposing your data and actions to an AI client — Claude, Copilot, Cursor, or an agent you run yourself. It is genuinely well-designed, the SDKs are good, and a server that returns rows from one table can be written in an afternoon.
Which is exactly why the market price for "a custom MCP server" has collapsed to a few hundred dollars. That price is real, and for a personal tool talking to a public API it is the right price.
It stops being the right price the moment the server is reachable by more than one person, touches data that belongs to your customers, or has to answer a procurement question. Then you are not buying a protocol adapter — you are buying an integration with an identity model.
What separates a script from an integration
Everything below is absent from a weekend build, and every item is something a security reviewer will eventually ask about.
- Identity
- The server knows who is asking. Requests carry a verified user identity, not one shared service credential that grants everyone the same access — which is the single most common flaw in a quick build.
- Authorisation
- Your existing permission model is enforced on every call. A salesperson asking through Claude sees exactly what they would see in the CRM — no more. Row-level and field-level filtering, applied server-side.
- Write safety
- Tools that change data are separated from tools that read it, gated behind explicit confirmation, bounded by limits, and reversible or logged well enough to reverse by hand.
- Audit trail
- Who asked what, when, through which client, and what came back. Retained on your terms. This is the artifact that makes the integration survivable in a regulated environment.
- Residency boundary
- Written down: where the server runs, where the data sits, which model provider sees which fields, and what never leaves your network. Field-level redaction before anything crosses a boundary you have declared.
- Operational fitness
- Rate limiting, connection pooling, graceful degradation when a backing system is down, health checks, and a pinned dependency set — so an upstream release does not take the integration with it.
Priced per data source
Prices in Canadian dollars, verified 23 August 2026. Sold as part of a broader automation engagement — we do not take standalone protocol-adapter work.
Single source
from $15,000CAD · One system, read-only, full identity modelIncluded
- Per-user identity and authorisation
- Audit logging with your retention policy
- Written residency and redaction boundary
- Client setup for Claude, Copilot or Cursor
- Source, deployment definitions and runbook
Not included
- Write access — see the next tier
- Additional systems
Multi-source & write
$34,000CAD · Three systems, write tools, approval gatesIncluded
- Everything in single source, across three systems
- Write tools with confirmation and limits
- Role-based tool visibility per team
- Cross-system queries with consistent identity
- Failure and permission-escalation testing
Not included
- Building APIs your vendors don't expose
- Changes to your identity provider
Hosting & care
from $1,800CAD / month · Or run it in your own tenancy at no feeIncluded
- Hosting in your chosen region
- Dependency pinning and tested upgrades
- Monitoring, alerting and incident response
- Protocol-version migration as the spec moves
Not included
- New data sources or new tools
- Your AI client subscriptions
An open standard, so you are not locked to anyone
MCP is an open protocol, which is most of its value. The same server works with any client that speaks it — so if your team moves from one AI tool to another next year, the integration does not need rebuilding.
That includes moving away from us. The server is your source, running on your infrastructure if you want it there, with no runtime licence and nothing phoning home.
How we handle data and residencyThe question we ask first
Before scoping anything, we ask what the server must never be able to do. Not what it should do — what it must not. That answer shapes the tool boundary, the credential model and the redaction layer, and it is much cheaper to get right at the start than to retrofit after a security review.
It is also, in our experience, a question nobody has asked the client before.
When you should not buy this
When one person wants to query a public API. Write it yourself, or pay someone a few hundred dollars. There is no identity model to get right and no auditor to satisfy. Our price would be absurd for that job and we will say so.
When an official server already exists. Many major platforms now publish their own MCP servers. If yours does, use it — the correct engagement is configuring and securing it, which is a fraction of a build.
When nobody has decided who is allowed to see what. An MCP server enforces a permission model; it cannot invent one. If access rules are informal today, formalising them is the prerequisite, and it is work you should do whether or not you buy this.
Questions worth asking first
If yours is not here, bring the systems you want reachable and the access rules that apply to them — we will tell you whether this is a build, a configuration job, or something you should not do at all.
Why does this cost more than the few hundred dollars an MCP server usually goes for?
Because a protocol adapter is not what you are buying. The market price for a custom MCP server has collapsed to a few hundred dollars, and for a personal tool talking to a public API that is the right price. It stops being the right price the moment the server is reachable by more than one person, touches data that belongs to your customers, or has to answer a procurement question — at that point you are buying an integration with an identity model.
Can we buy just the MCP server on its own?
No. It is sold as part of a broader automation engagement — we do not take standalone protocol-adapter work.
Our platform already publishes an official MCP server. Should we still buy this?
Probably not. Many major platforms now publish their own MCP servers, and if yours does, use it — the correct engagement is configuring and securing it, which is a fraction of a build.
If we move from Claude to Copilot next year, does the integration get rebuilt?
No. MCP is an open protocol, and the same server works with any client that speaks it — so if your team moves from one AI tool to another, the integration does not need rebuilding. That includes moving away from us: the server is your source, running on your infrastructure if you want it there, with no runtime licence and nothing phoning home.
Where does the server run, and what leaves our network?
It is written down: where the server runs, where the data sits, which model provider sees which fields, and what never leaves your network — with field-level redaction before anything crosses a boundary you have declared. Where we host it, hosting is in the region you choose; you can also run it in your own tenancy at no fee.
Start with what it must not do
Bring the systems you want reachable and the access rules that apply to them. We will tell you whether this is a build, a configuration job, or something you should not do at all.
Book a scoping call