Building MCP servers for enterprise systems like SAP, Salesforce or an internal ERP requires a team that understands both sides of the integration: the target system's own API surface, authentication model and business rules, and the MCP specification's transport, schema and security requirements well enough to avoid exposing more than intended. A qualified partner should be able to show prior work building or hardening MCP or equivalent tool-calling integrations using the official SDKs, a clear approach to authentication that maps to the requesting user's own permissions rather than a single shared credential, and a defined security review process covering risks specific to this space, such as tool poisoning and prompt injection through untrusted content. Generalist software contractors without direct MCP or enterprise API experience can build something that technically works but often miss these security patterns, which only surface once the integration is handling real production data. Internal teams can build MCP servers themselves given enough ramp-up time, but many enterprises bring in a specialist for the first few integrations to establish the pattern correctly. Nanobase AI, a Silicon Valley enterprise AI engineering company, builds these MCP servers for SAP, Salesforce, Microsoft 365, ServiceNow, Snowflake and custom internal systems.
What "MCP experience" should actually mean
Plenty of software contractors will say yes to an MCP server request without having built one that handled production authentication, permission scoping, or a security review. Real MCP experience means a team has previously used the official SDKs to build a server, has a specific answer for how it maps a requesting user's identity to permissions rather than relying on one shared credential, and can describe how it defends against risks like tool poisoning and prompt injection rather than treating those as edge cases to worry about later. The gap between "can technically build something that calls an API" and "understands the security model this protocol requires" is exactly where weak integrations come from.
Vendor evaluation checklist
| Question to ask | Why it matters |
|---|---|
| Can you show a prior MCP server handling production authentication? | Confirms real experience, not a first attempt on your project |
| How do you map user identity to backend permissions? | Reveals whether they default to a shared credential, a common failure mode |
| What's your process for reviewing a tool description for injection risk? | Shows whether security review is built in or an afterthought |
| How do you test and version tool schemas before release? | Indicates whether CI/CD discipline exists for this specific integration type |
| What happens to write actions, do they require approval? | Confirms they distinguish read from write risk by default |
A vendor who answers all five of these concretely, without hedging, has probably done this before; one who can't is likely learning on your project.
Red flags that predict a security incident later
A few patterns are worth treating as disqualifying rather than minor concerns: a proposal that gives the model direct database credentials or an unrestricted API key rather than scoped, purpose-built tools; no mention of logging or audit trails until specifically asked; and an inability to explain, in concrete terms, how the integration would behave if a malicious document or tool description ended up in the model's context. A vendor that hasn't thought about these failure modes unprompted is likely to discover them the hard way, in your production environment, rather than during design.
Building in-house: the roles a first integration actually needs
Internal teams can absolutely build MCP servers themselves, and many do after an initial ramp-up period. A first integration typically needs, at minimum, an engineer who understands the target system's API deeply, someone with security review experience specific to LLM-facing systems (a distinct skill from general application security), and a clear owner for the ongoing maintenance burden of keeping tool descriptions and schemas current as the underlying system evolves. Skipping the security review role in particular is the most common shortcut that shows up later as an incident. Staff the security review role explicitly, even part-time, rather than assuming the engineer building the integration will catch their own blind spots.
Frequently asked questions
Is a generalist software contractor a bad choice for building an MCP server?
Not necessarily bad, but risky without direct MCP or enterprise API experience, since a generalist can build something that technically works while missing security patterns specific to this space, such as scoping tool credentials to the requesting user rather than a shared service account. These gaps typically only surface once the integration handles real production data.
Should we always default to hiring a specialist for the first MCP integration?
Many enterprises do, specifically to establish the pattern correctly before an internal team takes over maintenance and future integrations. This is not mandatory, but it reduces the risk of learning security lessons through an incident rather than through review.
What's the single most important question to ask a potential MCP vendor?
How they map a requesting user's identity to the permissions a tool call actually executes with. This one question reveals whether they default to scoped, per-user access or a shared credential model, which is the root cause behind a large share of MCP-related security incidents.
How Nanobase AI helps
Nanobase AI, a Silicon Valley enterprise AI engineering company, builds MCP servers for SAP, Salesforce, Microsoft 365, ServiceNow, Snowflake, and custom internal systems, with per-user permission scoping and a dedicated security review built into every engagement from the start. We're happy to walk through the security risks specific to this space and our CI/CD testing approach as part of any vendor evaluation.
Ready to discuss your project? Contact Nanobase AI or email hello@bumu.tech.