Six months ago, almost nobody had heard of MCP. Today, we walk into businesses that have 20, 30, sometimes more of these things connected. QuickBooks. Gmail. Notion. Slack. Stripe. Drive. Every SaaS in the stack now ships an MCP server. Plug it into your AI agent and the AI can read your mail, send invoices, update your wiki.
It's powerful. It's also quietly breaking.
What MCP actually is, in plain English
MCP - Model Context Protocol - is a plug. Your AI on one side. Your business data on the other. The plug lets the AI read and write the data instead of just chatting with you about it.
That's the whole point of it. It's why AI goes from interesting demo to actually useful tool. The chatbot can't pay an invoice. The agent with a QuickBooks MCP plug can.
So far, so good.
What goes wrong at 30 connections
The problems don't show up at 3. They show up at 30.
Account confusion
Is the MCP server connected to your Gmail, or the admin account somebody set up in 2019 and forgot about?
Half the time, nobody knows. The AI is happily reading mail from an inbox nobody monitors. Replies go out. Customers see them. The owner has no idea. When we ask "whose account is this on," we get three different answers from three different people.
No idea who can see what
The intern's AI agent can search the leadership Notion. The contractor you brought in for two weeks last spring still has MCP access to QuickBooks. The new hire's agent has read access to every customer record in Drive.
There is no org chart for this stuff. There's no permissions page that shows it in one place. Every SaaS has its own settings, buried three menus deep, and the connections were set up by whoever happened to be sitting at the keyboard that day.
No audit trail
When the AI moved a customer record, who told it to? When it sent that email, who approved the draft? When it changed a price in QuickBooks, who knew?
Default MCP setups don't log this. So when something weird happens - and it will - you're forensic-ing a system that wasn't designed to be forensicked.
Tools that don't behave
An MCP server that worked perfectly in the demo starts timing out when your Notion hits 5,000 pages. The AI retries. Weird things happen. Half-formed pages show up. Duplicate customer records. A draft invoice that's also a final invoice.
Nobody noticed because nobody's watching.
This is not a reason to rip it out
MCP is genuinely useful. Being able to give an AI safe, scoped access to your actual business data is what makes it useful instead of just a chatbot.
But safe and scoped is the whole job. It's not a checkbox. It's an actual design problem, and it has actual answers:
- Use service accounts, not personal accounts. One identity per integration. Auditable. Survives employee turnover.
- Scope every connection to the minimum it needs. If the agent only reads invoices, it shouldn't be able to send them.
- Log what the AI does. Every read, every write, every send.
- Review the connections quarterly. Offboard people lose access. Stale integrations get cut.
- Have one person who owns the integration map. Not a committee. A person.
If you've got MCP sprawl and no idea what's connected to what, that's the first thing we fix. It's a half-day audit and it usually surfaces three or four things that need to be killed immediately.
The move
We do MCP audits. Quick, scoped, no jargon. You get a map of what's connected, where the risks are, and what to fix first.
First conversation's free.