There are two ways to make an ERP AI native. The common one is to bolt a chat window onto the product and let a model answer questions about the data. That produces a demo that impresses in a sales call and does nothing in the second month. The other way is to give the model real, typed, permissioned control over the system’s operations, so that it can act the same way a trained employee acts, through the same doors, subject to the same rules. That is what I built into Agaro ERP, and MCP is the shape of it.
Tools are the product, not the chat
The insight that changed how I work: tool design is the product. A model can only be as capable inside your system as its tools allow, and a poorly shaped tool set produces confident failures no amount of prompting fixes.
So the MCP surface in Agaro is not a generic SQL passthrough. It is a designed set of operations at the grain the business thinks in: raise an invoice, record a payment, adjust stock, generate a reorder suggestion, pull aging receivables. Each tool has typed inputs and typed outputs, defined failure modes, and a documentation string that states what it does and what it refuses to do. When a model misuses a tool, the fix is almost always in the tool contract, not the prompt.
Two design rules earn their keep daily. Tools are verbs at business grain, not table access, because “record payment” can enforce allocation rules that raw writes cannot. And every tool returns structured, honest results, including the error case, so the model can react to reality instead of imagining success.
Permissioning through the same doors
A person using the ERP cannot do everything, so a model using the ERP must not either. The MCP layer enforces the same permission model the human interface uses, scoped to the tenant, the role, and the session. The model never holds database credentials. It holds tool grants, which expire, which are logged, and which a human can revoke mid session.
This is the difference between AI native and AI bolted on. When the model acts through the application’s real control surface, every action it takes inherits the audit trail, the validation rules, the double entry guarantees, and the tenant isolation the product already has. Nothing new to secure, because there is no side door.
Human approval at the dangerous verbs
Not all verbs are equal. Reading a report is cheap. Posting a journal entry is not. The MCP surface carries a risk classification per tool, and the dangerous class requires an explicit human confirmation before execution, with the full effect of the action rendered in business language: what will change, by how much, for which tenant.
The judgment of where to draw that line is a product decision, and I made it deliberately conservative for anything that touches money or irrevocable state. Autonomy is a dial per operation, not a global switch, and the dial is set where a wrong action costs real money and cannot be undone with a query.
Why this wins in the mid market
The mid market companies Agaro serves do not want to learn software. They want the work done. A control surface done right means the ERP meets them where they are: an owner asks in plain language, the model proposes, the system constrains, a human confirms, and the ledger stays truthful underneath all of it. That stack, model, tools, permissions, confirmation, ledger, is what AI native actually means, and MCP is simply the honest interface between the first three and the last two.