Connecting AI to your business data: give it access, not control
MCP has become the default way for an AI to query company data. Wiring it up is the easy part. What decides whether you sleep at night are five questions almost nobody asks the vendor.
A general purpose AI answers well about the world and badly about your company. It does not know yesterday's revenue, which campaign brought the lead that closed, or why the number in the report does not match the bank statement. That is not an intelligence limit: that data never reached it.
The market gave three bad answers to this before giving a good one.
- Paste a spreadsheet into the chat. Works once, is stale the next day, and scales to nothing that changes hourly.
- Put an assistant inside the dashboard. It summarises the chart you were already looking at — which is rarely the problem.
- Upload the whole database to a model. Solves access and creates a bigger problem: you can no longer say who may see what.
What MCP changes
The Model Context Protocol is an open protocol for an AI application to talk to an external system. Instead of the AI wandering through your database, the system publishes a server that exposes three things: resources (what can be read), tools (what can be done) and prompts (how to do it properly).
The inversion is the point. The AI does not get a database password and freedom: it gets a menu. What is not on the menu does not exist for it — which is why the conversation about AI and sensitive data stops being philosophical and becomes an auditable list of permissions.
The right question is not "will the AI see my data?". It is "who wrote the menu, and what exactly is on it?".
Build or buy
| Build your own server | Use the vendor's connector | |
|---|---|---|
| Time to value | Weeks, and it restarts with every new source | Minutes: a URL and an authorisation |
| What you take on | Auth, scope, rate limits, auditing, maintenance | Configuring who can do what |
| When it wins | Data that only exists in your house, or very particular access rules | The sources the platform already knows |
| Hidden risk | A homemade server usually ships with full access, because that is easier | Trusting without asking how scope is enforced |
Neither column is the right answer for everyone. The mistake is choosing without reading the last row.
Five questions to ask whoever offers you a connector
These five separate a connector that respects your permission structure from one that only appears to. All of them come from real defects found in audits — including our own.
- 01Is the token bound to one project? If the AI can switch projects on its own, any conversation can end up reading the wrong client's data.
- 02Is the read scope enforced, or only declared? Marking a tool read-only in the docs prevents nothing. The server has to refuse the write at call time.
- 03When I remove someone from the team, when does their access die? If the active project travels inside a 90 day token and nobody re-checks, a former member keeps reading for three months.
- 04What can the AI write? Reading a report and deleting a dataset are very different powers, and should not ship in the same package by default.
- 05Does the query run isolated? If the AI can write SQL, it has to be blocked from naming another tenant's schema or a global table — in the server, not in the prompt.
Reading the authorisation and throwing it away is worse than never reading it: it looks like it was considered. A connector that checks the user's role and then ignores the result answers exactly like one that never checked.
The token detail almost everyone gets wrong
The third question deserves unpacking, because the trap is subtle. It is common for the active project to be validated once, at authorisation time, and then travel inside the token. Renewal copies the value forward without re-checking. It works perfectly — including for people who left the company.
The fix is not complicated, but it has to sit in the funnel every call passes through, and fail closed: an error reading the permission cannot become a free pass. With a short cache, the worst case stops being months and becomes about a minute.
What changes in practice
With the connector in place, the conversation stops being about charts and becomes about questions — including the ones that do not fit a dashboard because they cross sources:
- What did the lead that converted on yesterday's campaign actually cost?
- Which ads spent this week and produced no contact at all?
- How long passes on average between the ad click and the purchase — and how many sales fall outside the attribution window because of it?
- Which people bought without ever showing up in the CRM?
- Does this month's revenue match what the ad platform is crediting? If not, where is the gap?
None of these is hard to answer when the data lives in one place and the AI has a door with rules. All of them are impossible when the answer depends on exporting three spreadsheets and joining them by hand.
In CrazyLeads the MCP connector is part of the product: it only sees the active project, refuses a third party project in all three ways a project can be named, derives write scope from the tool's own annotation, and re-checks the person's membership before signing any call.