CRM and ERP systems hold the data that makes AI assistants genuinely useful — and they carry permission models, API constraints and data quality issues that make exposing them harder than a generic integration guide suggests.
What makes enterprise systems different
| Characteristic | Consequence for MCP design |
|---|---|
| Complex permission models | Must call as the user, not as a service |
| API rate limits and quotas | Caching and throttling are not optional |
| Heavy customisation | Custom fields and objects vary per deployment |
| Large, wide records | Must trim aggressively before returning |
| Mixed data quality | Duplicates and stale records reach the AI |
| Audit requirements | Access must be logged and reviewable |
The permission model is the decisive design constraint. Salesforce sharing rules, SAP authorisation objects and NetSuite roles are complex because businesses need them to be. Your MCP layer should authenticate as the requesting user and let the platform enforce its own rules — any attempt to reimplement that logic will drift out of sync and eventually leak data.
Tools worth exposing, by system
| System | High-value read tools | Gated write tools |
|---|---|---|
| CRM | Account summary, open opportunities, recent activity, contact lookup | Log activity, create task, update stage |
| ERP | Order status, stock by location, invoice status, delivery tracking | Create requisition, flag for review |
| Helpdesk | Ticket lookup, customer history, similar past tickets | Create ticket, add internal note |
| Finance | Invoice status, payment history, credit position | Nothing without approval |
Notice how narrow each tool is. "Get open opportunities for this account" is a tool. "Query Salesforce" is a security incident waiting to be logged.
Handling wide records
A CRM account object can have hundreds of fields, most of them irrelevant to any given question. Returning the whole record wastes context, costs tokens, and buries what matters.
- Define a summary shape per tool — the ten or fifteen fields that answer typical questions.
- Offer a detail tool for when more is genuinely needed.
- Resolve references — return the owner's name, not their record ID.
- Format dates and currencies readably rather than as raw values.
- Cap collection sizes — "most recent ten activities", not all of them.
Rate limits and caching
Enterprise API quotas were sized for human-paced usage. An agent can generate more calls in a minute than a team does in an hour, and exhausting your CRM quota affects every integration your business runs — not just the AI. Rate limiting and caching are protective of your whole estate, not just good practice.
- Cache reference data — picklists, users, product catalogues — with a sensible TTL.
- Do not cache transactional data such as stock levels or order status.
- Rate limit per user and globally.
- Monitor quota consumption and alert before exhaustion.
Data quality reaches the AI
Enterprise systems accumulate duplicates, incomplete records and stale entries. The AI will surface all of it confidently.
- Filter obviously stale records where the system marks them.
- Handle duplicates explicitly — return both and say so, rather than picking arbitrarily.
- Indicate recency so users can judge.
- Return "not found" clearly rather than an empty structure the model may misread.
Legacy and on-premise systems
Modern cloud platforms have clean APIs. Older on-premise ERPs frequently do not, and that changes the project shape:
- Assess what access exists — API, database views, file export, or nothing.
- Build an adapter layer first if there is no usable API. This is the real work.
- Consider a read replica rather than querying production directly.
- Then expose via MCP, which is straightforward once the adapter exists.
Budget accordingly. MCP over a documented cloud API is weeks; MCP over a legacy system without one is a systems integration project with an MCP layer on top.
A sensible first deployment
- One system, read-only, three or four tools covering the lookups your team does constantly.
- Permission mapping working properly — verified by two users with different access getting different results.
- Internal users only, with logging reviewed weekly.
- Add write tools behind confirmation once reads are proven.
- Expand to a second system, reusing the auth and logging patterns.
Wanting AI assistants to see your CRM or ERP safely? Tell us which systems and what your team looks up. See our MCP server service, MCP security, and secure enterprise data access.