Ting Guides · For the CTO and CIO
MCP or API: how do you connect an AI assistant to your CRM safely?
The short answer
Use both. Your CRM's API stays the way in to the data; an MCP server wraps that API as a few named tools any MCP-capable AI application can call, instead of one custom integration per application. Safety comes from what you build inside the server: the user's own permissions on every call, minimal fields, timeouts and logs.
Reviewed by Abdullah Al-RashedUpdated
What it depends on
What MCP is, and what it is not
The Model Context Protocol is an open standard that Anthropic introduced in November 2024 for connecting AI assistants to the systems where data lives. Its documentation says it "focuses solely on the protocol for context exchange" and does not dictate how AI applications use language models. It is a way in, not a security model.[1][2]
How many AI applications will connect
One assistant talking to one CRM can call the API directly. When a second or third AI application, or a second team, needs the same data, an MCP server in front of the API lets each of them reuse the same tools instead of a new integration each time.
How each application connects
MCP defines two transports: stdio, for a local server on the same machine, and Streamable HTTP, for remote servers, which supports standard HTTP authentication such as bearer tokens, with OAuth recommended for obtaining them. Check which transport and which authentication each AI application supports before you promise it will connect.[2]
What the AI should be allowed to do
Reading a customer file and creating a ticket are different risks. OWASP's guidance on excessive agency is to limit tools and their permissions to the minimum necessary, and to require a human to approve high-impact actions before they are taken.[4]
When does an MCP server beat a direct API integration?
MCP doesn't replace the API. The question is whether each AI application gets its own integration, or all of them share one server.
- Sales assistant
- Service assistant
- Reporting assistant
CRM API
Three integrations to build, update and secure separately
- Sales assistant
- Service assistant
- Reporting assistant
One MCP server
Identity and permission check on every call
CRM API
A new application connects to the same server and the same tools
| Question | Direct API integration | MCP server over the same API |
|---|---|---|
| Connecting a new AI application | Build another integration from scratch | It connects to the same server and uses the same tools |
| A change in the CRM | Update every integration | Update the server once |
| Where permissions live | Spread across each integration | Inside each tool, in one server |
| What the AI sees | Whatever each integration exposes | A list of named tools, each with a description and an input schema |
| Fits best when | One application, one system, a few calls | Several AI applications or teams need the same data |
How do you connect it, step by step?
1Read
Start with fictional data and one read-only tool
For example get_customer(customer_id). Don't start with deleting records or anything that moves money.
Use the official SDK in your team's language
Follow the current server quickstart in the MCP documentation, and record the SDK version in a pilot project before anything touches real data.[2]
Give each tool a clear name, description and input schema
get_customer takes customer_id and nothing else, and its description says it returns a customer file the signed-in user is allowed to see. Never let the model pick the company or entity from the text of the question.
2Permissions
Check identity and permissions inside the server
Take the user's identity, entity and permissions from the sign-in, a trusted source, and check that this user may see this customer before returning anything. A tool's description, or an approval prompt in the AI application, is not that check. MCP's security guidance is explicit that a server must not accept tokens that were not issued for it.[3]
Return the fewest fields, with limits
Return only the fields the request needs, set a timeout and a result-size limit, and write error messages that reveal no data and no secrets.
3Go-live
Connect one AI application, then the next
Confirm the first application lists the tools and uses them correctly. Connect a second one only after confirming it supports the same transport and authentication.
Then add one write tool
A tool such as create_ticket changes data, so it needs narrower permissions, a human approval when the impact is high, and protection against running twice.[4]
Log every call
Record who asked, which tool, when, and the result, without logging the full customer file or any access token.
One tool, as the AI application sees it
This is the definition the server returns when an application lists its tools: a name, a title, a description and an input schema. The description is written for the model, so it says exactly what the tool returns and for whom.
{
"name": "get_customer",
"title": "Customer file",
"description": "One customer file the signed-in user may see: name, owner, open orders, balance.",
"inputSchema": {
"type": "object",
"properties": {
"customer_id": {
"type": "string",
"description": "The CRM customer ID, for example C10482"
}
},
"required": ["customer_id"]
}
}The order of the checks inside the tool
A sketch, not a framework: verify the caller, fetch with a timeout, check the permission, log, and only then return the minimum. The same message for "not found" and "not allowed" keeps the tool from revealing which customer IDs exist.
def get_customer(request, args):
user = verify_token(request) # issued to THIS server; reject any other token
if user is None:
return error("Please sign in again") # no tool runs without a valid identity
record = crm.get_customer(args["customer_id"], timeout_s=5)
if record is None or not user.may_view(record): # entity, branch and role
log(user.id, "get_customer", args["customer_id"], "refused")
return error("Customer not found or not available to you")
log(user.id, "get_customer", args["customer_id"], "ok")
return pick(record, "name", "owner", "open_orders", "overdue_balance")What changes for companies in Saudi Arabia
General information, not legal advice. Each regulatory point summarises the official source cited beside it, as checked on the date shown under Sources; confirm how it applies to your company with your legal adviser.
Several entities on one CRM
When a group's companies share one CRM, the entity belongs to the user's identity from the sign-in, never to the words of the question. A request for another entity's customer is then refused by the server, whatever the prompt says.
Customer records and model hosting
A tool that returns customer files sends personal data to wherever the AI model runs. If that is outside the Kingdom, Article 29 of the Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H) sets the conditions for the transfer, including an adequate level of protection and limiting it to the minimum personal data needed, and the Transfer Regulation sets the exemptions from those two conditions and the safeguards they require (Article 4). Returning the fewest fields is good engineering and fits the minimum-data condition; whether the transfer is allowed is a question for your legal adviser.[5][6]
Arabic questions, English tool names
Keep tool names in English snake_case, but write descriptions that cover how your users actually ask, and test Arabic questions that name customers in Arabic and in Latin letters.
The fifteen-minute permission test, filled in
ExhibitWorked example
Six cases to run before any AI application connects, here at the fictional Rasikh Holding, where Rasikh Motors and Rasikh Trading share one CRM. If one case fails, fix it before connecting anything else.
| Case | Request (fictional) | Correct result | In this run |
|---|---|---|---|
| Allowed request | Sara, sales at Rasikh Motors, asks for Rasikh Motors' customer C10482 | The file comes back with four fields only | Pass |
| Outside her permissions | Sara asks for Rasikh Trading's customer C20931 | Refused before any data leaves the server | Failed, then fixed |
| Incomplete request | customer_id left empty or mistyped | A clear error message | Pass |
| CRM slow or down | The CRM doesn't answer within five seconds | A timeout and a safe message, no retry loop | Pass |
| Invalid sign-in | An expired session, or an application that isn't approved | No tool runs | Pass |
| Same request, two applications | Sara asks the same question in two AI applications | Same result, same permissions | Pass |
The decisionConnect the first application. The one failure leaked nothing from the record itself: the error said "not allowed" for real IDs and "not found" for unknown ones, which showed which IDs exist in another entity. One message now covers both, and the case passes.
Questions people ask
Does MCP replace our CRM's API?
Is an MCP connection secure by default?
Do we need MCP if we only use one AI application?
What Ting does and doesn't do here
What we do
- We define the tools, permissions and approval rules in an AI Solution Blueprint, then build the server on your CRM's existing API.
- We run the permission tests on fictional data first, then on the agreed live scope, before any application connects, and hand over the logs and runbooks.
Where Ting helps: Custom AI Implementation
What we don't do
- We don't give an AI application a shared all-access account to your CRM.
- We don't connect write tools before the read-only tools pass their tests.
Sources
Primary sources only, each read in full on the date shown.
- Introducing the Model Context Protocol (25 November 2024)Anthropic · checked
- Architecture overview: hosts, clients, servers, tools and transportsModel Context Protocol · checked
- Security Best Practices: token passthrough and scope minimizationModel Context Protocol · checked
- LLM06:2025 Excessive AgencyOWASP GenAI Security Project · checked
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H)SDAIA · checked
- Regulation on Personal Data Transfer outside the Kingdom, version 2.0 (August 2024)SDAIA · checked
