Use caseAI agentCustom software

Connect your ERP and CRM to Claude, ChatGPT or Copilot without handing over the keys

A custom MCP server that gives Claude, ChatGPT and Copilot scoped access to SAP Business One and your databases: read-only by default, writes behind approval.

A blueprint, not a client story. The business described is illustrative; the architecture, integrations and trade-offs are real, and this is how I would build it. By Ergini, September 11, 2026.

The short version

A custom MCP server that lets Claude, ChatGPT or Microsoft Copilot look things up in SAP Business One, HubSpot and your own databases on behalf of each employee. Instead of the whole API, it exposes a handful of purpose-built tools, such as checking stock or drafting a quote. People sign in through your identity provider and see only their own scope, anything that writes waits for a person's approval, and every call is logged.

Best for: Companies whose staff already paste ERP or CRM data into chat assistants, on systems with no official MCP server, like SAP Business One.
Connects to: SAP Business One, HubSpot, Postgres or SQL Server database, Claude, ChatGPT and Copilot Studio, Microsoft Entra ID or another OAuth provider, Microsoft Teams
The AI does: The assistant your staff already use picks which tool to call and writes the answer. The server itself contains no model at all.
People do: Decide which tools exist and who may call each one, approve writes above set limits, and turn draft quotes into real ones in the ERP.
Built as: AI Integration, usually $3.5K - $15K

The ERP is already in the chat window, one paste at a time

Picture an 80-person distributor of hydraulic fittings, hoses and pneumatics, selling to machine builders and repair shops in Austria and southern Germany. Orders, stock, prices and invoices live in SAP Business One. The pipeline lives in HubSpot. Truck routes and drop windows sit in a small Postgres database behind a planning tool a contractor built years ago.

The sales team found chat assistants on its own. Each morning a few reps export stock and open orders from B1 to Excel, then paste pieces into ChatGPT or Claude all day to write quotes and replies. It works until it does not: the export is stale by ten, the paste lands in whichever account the rep has open, sometimes a personal one, purchase prices travel along with selling prices, and nothing records any of it. It is copy-paste between apps with a language model at the end.

The fix is to give those assistants a proper connection. MCP, the Model Context Protocol, is the standard Claude, ChatGPT and Copilot Studio all use to call outside tools, and since December 2025 it has been governed by the Agentic AI Foundation under the Linux Foundation rather than by a single vendor. A company runs an MCP server offering a few tools, staff connect their assistant and sign in, and the assistant then looks things up live, as that person and within that person's rights.

Which systems already have an official MCP server

The first question is whether you need a build at all. Many systems now publish their own server, usable from Claude, ChatGPT and Copilot Studio alike, and for those the answer is usually to use it.

System	Official MCP server	What I would do
HubSpot	Yes: remote, OAuth, CRM read and write	Use it, and build only what it cannot do
QuickBooks Online, Xero	Yes: official servers from Intuit and Xero that run locally	Use them, wrapped if writes need approval rules
Stripe	Yes: remote, OAuth or restricted keys	Use it with human confirmation of tool calls, as Stripe advises
Slack	Yes, for Marketplace and internal apps only	Use it through an internal app
Microsoft 365	Yes: Work IQ servers for Teams, SharePoint, calendar and more, through Agent 365	Use them inside your tenant
Atlassian, Notion	Yes; Atlassian's is permission-aware	Use them
SAP Business One, Odoo, DATEV, Pipedrive	No official server; community ones at most	Custom server, or Zapier's MCP for light Pipedrive use
Your own database or app	No, by definition	Custom server over prepared views, never raw SQL

Checked against the official MCP registry and vendor documentation in September 2026. Community servers exist for most systems, and a registry search for Shopify alone returned 22 entries, almost all unofficial. Nobody vouches for what those do with your credentials.

A quote request in Claude, with the calls behind it

The rep types one message. The model in Claude decides which tools to call; the server decides what this rep may see and what may be created.

Claude, Thursday 10:12

Sales rep · Claude
K10442 wants 400 HX-2240 fittings and 60 m of HS-16 hose by Friday next week. Can we do it, and at what price? Draft a quote if we can.
find_customer(query: "K10442")machine builder, Linz / account owner: this rep / price list OEM-B / 30 days net / no credit hold
check_stock(items: ["HX-2240", "HS-16"])HX-2240: 460 free across two warehouses / HS-16: 42 m free, 200 m on a purchase order due 18 Sep
get_delivery_slots(postcode: "4020", before: "2026-09-18")Linz route: Tue 15 Sep, Thu 17 Sep
get_price(customer: "K10442", items: ["HX-2240", "HS-16"])HX-2240: EUR 4.18 each (OEM-B, 250+ break) / HS-16: EUR 11.90 per m / source: B1 price list
draft_quote(customer: "K10442", lines: 3, deliver: "2026-09-17", key: "q-7f2c")B1 draft 5531 created / not a quotation, not sent / discount 0%, within limit
Claude · Claude
Mostly. The 400 fittings are in stock for the Thursday 17 September truck to Linz, at EUR 4.18 each on their OEM-B price list. The hose is the constraint: 42 m is free, and the next 200 m arrive a day after that truck. Draft 5531 in SAP has the fittings and 42 m for Thursday, and the other 18 m on the 22 September truck. Nothing has been sent; the office turns the draft into a quotation in B1.
Had the rep asked for 12% off, draft_quote would have refused anything above the rep's 5% limit and sent an approval request to the sales manager in Teams instead.

Prices and stock came from B1 at the moment of asking, not from a morning export. The only thing the assistant could create was a draft, and the idempotency key makes a retried call return draft 5531 rather than a second draft.

Inside the server, from tool call to audit log

The only model in this picture runs inside Claude, ChatGPT or Copilot. The server is ordinary code, deliberately: it is where the rules live that no prompt can argue with.

01 Trigger · Claude, ChatGPT, Copilot Studio
Someone asks their assistant
A rep, a buyer or someone in finance asks a question in Claude, ChatGPT or Copilot, signed in with a company account.
02 AI model · MCP over streamable HTTP
The assistant's model picks a tool
From the tool names and descriptions, the model decides to call, say, check_stock with two item codes. It is the only model in the chain, and it runs at the vendor, not on your server.
03 Plain code · Entra ID, OAuth 2.1
Check the token and the person
The server validates the token's signature, expiry and audience, and rejects any token not issued for it; the MCP specification forbids passing a user's token through to other systems. Entra groups then decide the person's role, region and B1 sales employee code.
04 Plain code
Apply the person's scope
A policy table in version control decides which tools and fields each role gets, and arguments are validated against each tool's schema. A rep sees selling prices for their own accounts, never purchase prices or margins.
05 System · SAP B1 Service Layer, Postgres views
Read from the source, gently
B1 is called through the Service Layer from a small session pool, under per-person and global rate limits and a ten-second timeout, with stock cached for sixty seconds. The delivery database is read through views by a read-only role.
06 Decision
Does this call change anything?
Code decides, from the policy table and the values B1 returns.
- A read then return only the fields the tool promises, trimmed and marked as data
- A draft quote within the person's discount limit, for a customer without a credit hold then create one B1 draft, deduplicated by its idempotency key
- A discount above the limit, a credit hold, or a write tool not enabled for this role then no write; an approval request goes to the sales manager in Teams
- B1 does not answer in time then a clear error the assistant can pass on, and no automatic retry of writes
07 Person
A person approves or finishes the job
The sales manager sees customer, lines, requested discount and rep in a Teams card, and approves or declines. Office staff turn drafts into quotations in B1, as they do today.
08 Result · Append-only log
Every call lands in the audit log
Who asked, through which assistant, which tool, the arguments, the decision and the time. Tool results are not stored, so the log never becomes a second copy of the ERP.

Eight tools, and the line each one cannot cross

Tools follow the tasks people actually do, not every endpoint. A short list means the model picks the right tool more often, and each tool is a permission boundary with its own tests; see tool calling best practices.

Tool	What it does	Who can call it	What it can never do
find_customer	Finds a customer by name, number or VAT ID	Sales, service, finance	Return customers outside the caller's region, except for finance
get_customer_terms	Payment terms, credit limit, open balance, credit hold	Sales managers, finance	Show bank details or change terms
check_stock	Free, committed and on-order quantities per warehouse	Everyone	Show purchase prices or supplier names to sales
get_price	The customer's selling price from their B1 price list	Sales	Accept a price from the assistant: prices only ever come from B1
get_open_orders	Open sales orders and promised dates for one customer	Sales, service	Show orders of customers outside the caller's scope
get_delivery_slots	Next truck dates for a postcode	Everyone	Run anything except its prepared view
find_datasheet	A link to the product datasheet	Everyone	Return documents marked internal
draft_quote	Creates a B1 draft quotation	Sales	Create a real quotation, send anything to a customer, or exceed the caller's discount limit

Each tool carries MCP's read-only or destructive hint so clients know to ask before a write. The specification tells clients to treat such hints as untrusted, so the server enforces every line above itself.

The parts that are harder than the demo

A demo server with one tool takes an afternoon. These are the parts that take the rest of the build.

Data that carries instructions

A B1 remarks field or a HubSpot note copied from a customer's email can contain text aimed at the model. Tool results come back as structured fields, free text is truncated and labeled as data, and no tool can send anything outside the company, so an injected instruction has nowhere to go. The prompt injection guide explains why that matters.

One technical user, fifty real ones

B1 sees a single technical user, so the server, not B1, enforces who may see what. The policy table is code-reviewed and tested with one test account per role. Whether people who reach B1 data through an integration need licenses of their own is a question for your SAP partner and your contract, best settled before rollout.

Tokens that outlive the person

Access tokens are short-lived and bound to this server. The B1 service credentials sit in a secrets vault and never reach a client. Disabling someone in Entra ID ends their access at their next call, not at the next password change.

An assistant stuck in a loop

Models retry, rephrase and sometimes call the same tool thirty times. Rate limits per person and per tool, a capped session pool and short caching mean a runaway loop hits a limit, never the ERP that invoices your customers.

Why there is no run_sql tool

A free-form SQL tool makes the fastest demo and the worst production system: injected queries, accidental full-table reads, answers built on joins nobody checked. Every query here is written in advance, parameterized, and run by a read-only role against views.

The server from a stranger's GitHub

Community MCP servers run with whatever credentials you hand them. In 2026 a trojanized MCP server for the Oura ring delivered an infostealer, and an unauthenticated MCP endpoint in nginx-ui left more than 2,600 instances exposed. A custom server has a known author, pinned dependencies and code you can read.

The order I would switch it on in

Read-only tools for three or four reps, in the assistant they already use, with the audit log reviewed daily for the first week.
The same server added to the company's other assistants, with sign-in tested in each, because Claude, ChatGPT and Copilot Studio handle connectors slightly differently.
draft_quote switched on, with confirmation in the chat and the Teams approval for discounts above each rep's limit.
The whole sales team, then purchasing and finance with their own scopes. New tools only on request, each with an owner, a test and a line in the policy table.

Nothing writes to the ERP in the first stage, so the only early risk is a wrong answer, and the log shows it.

Official server, Zapier, or a server of your own?

Use the official server wherever one exists. HubSpot, Stripe, Xero, QuickBooks Online, Slack, Atlassian and Notion all publish their own, and they will follow their own API changes faster than any custom server. For breadth across many apps with simple actions, Zapier's MCP server covers thousands of apps for little effort, and connector vendors such as CData sell ready-made MCP servers for common systems. For a team that mainly reads HubSpot and QuickBooks from Claude, that is the whole answer.

A custom server earns its place when there is no official one (SAP Business One, Odoo, DATEV, an in-house database), when your permissions are finer than the vendor's (reps who may see selling prices but not margins), when business rules must sit between the assistant and the system (discount limits, credit holds, drafts instead of documents), or when you want one audited entry point that behaves the same in Claude, ChatGPT and Copilot Studio. The engineering is covered in building a production MCP server.

Most companies end up with a mix: official servers for HubSpot and Microsoft 365, a small custom server for the ERP and the database, and an allowlist in each assistant's admin console so staff can connect only approved servers. A private AI gateway is a natural place to enforce that list. Offering your own product to customers' assistants is a different job, covered in the SaaS MCP server use case.

How you would know it is working

A blueprint has no results to report, so here is what I would measure from the first week instead, on your own data.

Tool calls per person per week: From the audit log. A server nobody calls is a server to switch off, and a sudden spike is worth a look.
Drafts that become quotations: The share of B1 drafts the office converts rather than deletes, the plainest test of whether the drafts are useful.
Refusals by reason: Out of scope, over limit, missing approval. Many refusals mean the policy or the tool descriptions are wrong.
Load on the ERP: Service Layer calls per minute and response times, before and after. The server must never be the reason B1 is slow.

What a build like this costs

This is built as AI Integration, which runs $3.5K - $45K overall. A build like this one usually lands in the single AI feature tier: $3.5K - $15K, 1-3 weeks. The first working version runs on your real data well before the end of that window.

What it costs to run

The server is small: a container and a database for the audit log, usually tens of dollars a month to host. Model costs sit in the assistant subscriptions your staff already have. The real running cost is attention: someone reading the audit log and deciding on new tool requests.

What moves the price

How many tools write: a lookup is quick, a write with approvals and idempotency is several times the work
Where the system runs: a cloud API, or an on-premise B1 that needs a secure tunnel or relay
How fine the permissions are: one role for all, or rules per region, account and field
How many assistants must work with it, since each handles sign-in slightly differently
Audit requirements: retention, who reviews the log, and whether it feeds your SIEM

Who this is for

Distributors and manufacturers on SAP Business One, Odoo or another ERP with no official MCP server
Sales teams already pasting ERP exports into ChatGPT or Claude, with or without permission
SaaS companies that want support staff to query the internal admin database without SQL access
IT leads who found community MCP servers on staff laptops and want one approved route instead

Questions people ask about this

Is there an MCP server for SAP Business One?

Not an official one, as of September 2026: the registry lists only community servers for it. A custom server over B1's Service Layer gives Claude, ChatGPT or Copilot a few scoped tools, such as customer lookup, stock, prices and draft quotes, with your permissions, approvals and audit log built in.

Can I connect QuickBooks or HubSpot to Claude?

Yes. Intuit publishes an official QuickBooks Online MCP server with OAuth, covering invoices, bills, customers, vendors, estimates and reports, and Xero has one too. HubSpot's official remote server reads and writes CRM records and is listed in Claude's connector directory. Use them as they are; build around them only when writes need approval rules or the data must meet an ERP.

Our ERP is old and has no API. Can Claude or Copilot still work with it?

Usually, for reading. If the database is reachable, an MCP server can offer lookups over read-only views without touching the application. Writing is the careful part: through the vendor's import mechanism where one exists, or a supervised screen-level agent where none does, never with direct database writes. The legacy system automation use case covers the second route.

Is giving ChatGPT access to our ERP a breach waiting to happen?

It can be, if it means a broad API key and a community server. Done properly, access runs through company accounts only, each person has their own scope, tools are read-only unless approved, there is no raw SQL, and every call is logged. Either way, whatever a tool returns goes to the assistant's vendor, so their business terms and your data processing agreement matter as much as the code.

How much does a custom MCP server cost to build?

A read-only server with a handful of tools over one system is a small build, in the lowest AI integration tier shown on this page. Write tools with approvals, several source systems, on-premise connectivity and fine-grained permissions move it up. Running it costs little; the ongoing work is reviewing the log and choosing which tools to add.

Sources