MCP Could Become the Plug Between AI and Your ERP

A Standard Takes Hold

In November 2024, Anthropic introduced the Model Context Protocol, or MCP, an open standard for connecting AI applications to the systems and data they need to work with. The idea was simple: instead of every AI application needing its own custom connector for every system, a system could expose its data and functions once, through an MCP server, and any compatible AI application could use them.

Adoption has moved quickly. In March, OpenAI announced that it would support MCP in its products. In April, Google said its Gemini models would support it as well. And at its Build conference this month, Microsoft announced broad support for MCP across its platforms, including Windows, and said that Microsoft and GitHub were joining the protocol's steering committee.

When the major competitors in a field all agree to support the same standard within a few months, it is worth paying attention.

When the major competitors in a field all agree to support the same standard within a few months, it is worth paying attention.

Why This Matters for Manufacturers

For a manufacturer, the value of AI depends almost entirely on access to the company's own information: orders, inventory, bills of material, schedules, quality records, maintenance history. Today, connecting an AI application to an ERP usually means a custom integration project, and that integration only works with the one application it was built for.

A common standard changes the economics. If the ERP, or a layer in front of it, exposes a well-defined set of capabilities through MCP, such as looking up order status, checking inventory, or retrieving a bill of material, then any compatible AI assistant or agent can use those capabilities. The integration is built once and reused, and the company is less locked into any single AI provider.

Expect ERP vendors and their partners to start publishing MCP servers for their products. Manufacturers can also build their own, particularly for older systems their vendors are no longer investing in.

The Plug Works Both Ways

A standard that makes it easy to connect AI to business systems also makes it easy to connect AI to business systems badly.

An MCP server gives an AI application the ability to read data and, potentially, to take actions. If it is set up with broad permissions, the AI can see and do far more than any single task requires. AI models can also be manipulated by instructions hidden in the content they read, a risk known as prompt injection. An agent that reads a supplier email containing malicious instructions and has the power to change purchase orders is a genuine concern, not a theoretical one.

Controls to Put in Place

The controls are the same principles that apply to any system integration, applied with extra care. Start with read-only access. Many of the most useful applications, answering questions about orders, inventory or history, require no ability to change anything. Add write capabilities one at a time, for specific, narrow actions, and only after the read-only use has proven itself.

Use least privilege. An MCP server should expose only the functions a particular use case needs, under an identity with only the permissions those functions require, not an administrator account. Log every request and every action, with enough detail to reconstruct what happened. Require human approval for actions above a defined threshold, such as order changes over a certain value or any change to master data.

Finally, be careful about which MCP servers you install. A connector published by an unknown party is software with access to your systems, and it deserves the same scrutiny as any other software you would install.

Start Small

A sensible first project is a read-only MCP server that lets an AI assistant answer common questions from your ERP: where is this order, how much of this part do we have, what is the lead time from this supplier, what was the last price paid. These questions consume a surprising amount of time across sales, planning and purchasing, and answering them carries little risk. The project also forces useful decisions about data access and security that every later AI project will need.

The Bottom Line

MCP is quickly becoming the common way to connect AI applications to business systems, with support from Anthropic, OpenAI, Google and Microsoft. For manufacturers, it could make connecting AI to the ERP far cheaper and reduce dependence on any one AI provider. It also makes it easy to grant AI too much access. Start with read-only use cases, apply least privilege and logging, require approval for consequential actions, and vet every connector before it touches your systems.

At Cherry Street, this is the work we do. We help manufacturers decide which ERP capabilities to expose to AI, build MCP servers with the right permissions and logging, and design the first applications so they are useful from day one and safe as they grow.