What sold us was being able to limit what the agent sees. We didn't want the model querying our entire database, so we scoped it down to the specific tables that matter. The agent can list those tables, look at the columns, and query them, but nothing outside that. That made the conversation with our security person a lot shorter. They could see exactly what was exposed instead of having to trust a black box. We connected our main sources in an afternoon and set the scope right after.

The thing we use most is being able to write our own functions in Python and expose them to the agent as tools. We had a specific workflow (pulling a customer's order history from a few sources and formatting it a certain way) and instead of trying to get the agent to do it step by step, we wrote one script and now the agent calls it directly. It connects to the usual things too. Our agent reads from our CRM and warehouse through the same endpoint. But the custom tool part is what made it actually fit how we work. Getting started was simple, an API key and the endpoint, and we were testing in Claude the same day.

We came in looking for an MCP layer, but the ELT and warehouse side ended up being just as valuable for us. We were able to bring our SaaS data into one place, do a bit of SQL cleanup, and then expose the cleaned views to our agent. That meant the agent's answers were grounded in numbers our finance team already trusted. The MCP endpoint sitting on top of that warehouse is what makes the whole thing work for us. Same data the team sees in their dashboards, same data the agent uses to answer questions.