Custom MCP Server Development
An AI agent becomes useful the moment it can act on your own systems. I build the MCP servers that connect agents to your CRM, your databases, and your internal tools, with the permissions scoped and the credentials out of reach.
Custom MCP server development is the work of building a Model Context Protocol server that exposes your own systems — a CRM, a database, an internal admin panel — as tools an AI agent can call. Oleg Sotnikov builds production MCP servers, including the part most teams underestimate: deciding which operations an agent may run and keeping credentials out of its reach. He wrote and maintains sallyport, an open-source Mac vault that runs authenticated actions for AI agents over MCP, where the agent gets the operation and never the key.
What I Build
Six kinds of MCP work I take on. Most engagements combine two or three of them.
Internal-tools servers
Servers that let an agent work inside your CRM, ERP, or admin panel: create the ticket, update the record, issue the refund. Each action is scoped to what the calling role is allowed to do.
Data-source connectors
Read access to the places your answers live — databases, the warehouse, document stores, internal wikis. Queries are shaped and limited on the server, so an agent cannot walk an entire table to answer one question.
Auth-safe action servers
The sallyport pattern: the server holds the credential and exposes the operation. The agent can send the message or rotate the token, but no call returns the secret and there is no export route.
Agent-ready API wrapping
Your REST or GraphQL API already works for developers. Making it work for agents is a different job — fewer and larger operations, honest error messages, descriptions a model can act on without guessing.
Deployment and observability
The server runs where your data already lives, with logs, per-call metrics, and an audit trail. When someone asks what the agent did last Tuesday and on whose behalf, the answer is in the log.
Security review of an existing setup
You already run MCP servers and want a second pair of eyes. I review what they expose, where tokens are stored, what a prompt-injected agent could reach, and what to close first.
How It Works
Scope the tools and permissions
We write down what the agent should be able to do and, more importantly, what it must never do. Every tool gets a boundary: which records, which actions, which environment, on whose authority.
Build and test against real agent workflows
I build the server and run it inside a real host against the workflows you want automated. Then I rewrite tool names and descriptions until the agent picks the right one on its own, because that is where most MCP integrations quietly fail.
Deploy, hand over, document
The server ships to your infrastructure with logging and audit trails wired up. You get the repository, a runbook, and a walkthrough, so your own engineers can add the next tool without me.
Why Me
- I wrote and maintain sallyport, an open-source Mac vault that runs authenticated actions for AI agents over MCP — the agent gets the operation, never the key
- AppMaster processes 11B+ tokens a month, so agent tool ergonomics — what a model calls correctly under load — is daily work here, not a side interest
- 25+ years in engineering, 7 patents, and production systems serving users in 190+ countries at 99.99% uptime
Related Work
An MCP server is usually one piece of a larger AI plan. These pages cover the rest.
Frequently Asked Questions
What is custom MCP server development?
It is the work of building a Model Context Protocol server for your own systems so that AI agents can call them as tools. MCP is an open protocol introduced by Anthropic in November 2024 that standardizes how a model reaches data and actions outside its context window. The custom part is what nobody can ship for you: your CRM, your database schema, your permission rules.
How much does a custom MCP server cost?
It is scoped per engagement. A read-only connector to one database and a permissioned action server spanning four internal systems are different projects, and quoting them the same way would be dishonest. Many clients enter through the fixed-price Team & AI Audit at $5,000, which sizes the work before anyone commits to a build; retainer and advisory rates are on the pricing page.
How long does it take to build an MCP server?
A single connector over a clean, documented API is usually days of work. A server that performs real actions across several internal systems, with permissions and audit trails, runs into weeks — and most of that time goes to the boundaries and the testing, not to the protocol itself. After scoping I give a range and tell you which parts of it are uncertain.
How do you keep our credentials safe?
The server holds the credential and the agent gets the operation. That is the pattern behind sallyport, the open-source MCP vault I maintain: a tool can perform an authenticated action, but no call returns the stored secret and there is no export route. With per-tool permissions and an audit trail on top, an agent that gets compromised or prompt-injected is confined to actions you already approved.
Does MCP only work with Claude?
No. Anthropic introduced MCP as an open standard, and a server written against the protocol works with any host that speaks it — Claude, coding assistants inside IDEs, and other agent frameworks that have added support. You build the server once, against the protocol rather than against one vendor.
Connect Your Agents to Your Systems
Bring one workflow you want an agent to handle. We will scope the tools, the permissions, and what shipping it actually takes.
30 minutes, no charge. If MCP is the wrong tool for your problem, I will say so on the call.
Related reading
Agents, tools, and the engineering that keeps them safe in production.
