# MCP Server Development Source: https://ordergroup.co/ai-software-development/mcp-server-development/ Last updated: 2026-10-20 > MCP server development services on your existing API, with tokens, a call log and server-side gates, as on our own production MCP server. Free consultation. # MCP server development services for products AI agents should use An AI agent that can write to your system should not depend on the prompt to follow your rules. We build MCP servers where those rules live on the server, the way we run our own MCP server for the CMS behind this website. [Book a free consultation](https://ordergroup.co/contact-us/) Tell us what AI agents should do in your product. A short description of your API and your users helps us prepare the free consultation. - ![AASA24](https://ordergroup.co/media/images/aasa24-mono.max-208x64.format-webp.webp) - [![AP-Tech](https://ordergroup.co/media/images/ap-tech-mono_ihuJP5T_6b2rSSb.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/monster-airport-lighting-system/) - ![Avafin](https://ordergroup.co/media/images/avafin-mono.max-208x64.format-webp.webp) - [![BizBot](https://ordergroup.co/media/images/bizbot-mono_StdJIUN.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/bizbot-fintech-ux-design/) - [![Enerace](https://ordergroup.co/media/images/enerace-mono_FKuME1X_Fp3WF4B.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/enerace-energy-trading-software/) - ![Filmgrail](https://ordergroup.co/media/images/filmgrail-mono_gPdfbHO.max-208x64.format-webp.webp) - [![Kyoto Group](https://ordergroup.co/media/images/kyoto-group-mono_hlqECHG.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/kyoto-digital-twin-software/) Tools on our MCP server **164** MCP tools on our production server, as of 20 October 2026 Production MCP server **Jul 2026** our MCP server for the CMS of this website has run since 9 July 2026 Public MCP endpoint **Oct 2026** https://ordergroup.co/mcp, listed in the official MCP registry Server-side gates **3** HTTP 400 and 409 responses; no tool has a parameter to skip them Public tools **2** list_case_studies and submit_project_enquiry, without a token ## MCP server development services: who they are for and what we run ourselves Our MCP server development services give AI agents a controlled way into your product: an MCP server built on the API you already have, where the rules agents must follow are enforced by the server. This work is part of our [AI software development](https://ordergroup.co/ai-software-development/). The [Model Context Protocol (MCP)](https://ordergroup.co/glossary/model-context-protocol/) is an open standard that connects AI applications to external data and tools. According to Anthropic's December 2025 announcement, ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code support it, and since then the protocol has belonged to the Agentic AI Foundation, hosted by the Linux Foundation. We build MCP servers for CTOs and product owners whose product already has an API and whose users or teams want to work with it through an AI assistant. Since 9 July 2026 we have run a production MCP server for the CMS behind this website, built on Wagtail. On 20 October 2026 it had 164 tools covering pages, content, SEO and GEO (visibility in AI search), schema.org, media, menus, redirects, Search Console and GA4 analytics, and leads. Together with our public MCP endpoint, described below, it is all the MCP work we have built and run so far. We describe the CMS server in detail in [MCP vs API: what we learned running an MCP server in production](https://ordergroup.co/blog/mcp-vs-api/). ![Long-term platform support team (Unsplash)](https://ordergroup.co/media/images/photo-1551434678-e076c223a692fmj.format-webp.width-2880.webp) ## How we build an MCP server on top of your existing API We build the MCP server as a thin layer over your existing REST API. In our own server, every MCP tool calls an endpoint of the CMS API under /ai-api/. Validation and permissions therefore live in one place, the API, and are not written a second time in the MCP server. The server runs on the official MCP SDK for Python (FastMCP, package mcp 1.28.1). Locally it talks over stdio, and in production over the streamable HTTP transport. Every request carries the token of one person or one integration in the Authorization: Bearer header. The API validates and logs that token, and an administrator manages tokens and reviews the call log in the Wagtail admin panel. ### Decisions in an MCP server, and how we made them in ours What to decide when you build an MCP server, and how we did it in our own production server. | Decision | What to decide | How we did it in our server | |---|---|---| | API layer | Does the MCP server hold logic, or call an existing API? | Thin layer: every tool calls the CMS REST API under /ai-api/ | | Transport | How do clients connect? | stdio locally, streamable HTTP in production | | Authentication | Who is calling? | Token of one person or integration, Authorization: Bearer | | Call log | Who did what? | Every call validated and logged by the API, visible in the Wagtail admin panel | | Rules the agent must not break | Prompt or server? | Server: HTTP 400 and 409 responses | | Public scope | What can anyone use without a token? | Read and contact only, on a separate endpoint | | Registry | Where is the server published? | Public endpoint listed in the official MCP registry as co.ordergroup/public | ![Server racks with network and fibre cables in a data centre](https://ordergroup.co/media/images/photo-1558494949-ef010cbdcc31w24.format-webp.width-2880.webp) ## Designing custom MCP server tools the model can choose correctly A custom MCP server works only if the model picks the right tool. An MCP server publishes a list of tools, each with a name, a description and a typed input schema. The AI client asks what is available and passes those descriptions to the model, which chooses. The model never sees the code behind a tool, so its descriptions and input schemas decide whether it gets called at the right moment. In our own deployment, the tool list follows the scope. The CMS server, which needs a token, has 164 tools covering pages, content, SEO, media, menus, redirects, analytics and leads, and each tool calls an endpoint of the CMS API. The public endpoint, which anyone can call without a token, stops at two tools: one lists our case studies and one sends a project enquiry. Every write to the CMS stays behind a token. ## Server-side gates: what an AI agent cannot do On our MCP server, the rules an agent must not break are response codes and validation on the server. An instruction in the prompt only explains them. Three gates decide what an agent can create, write and publish: 1. **No page without a strategy brief.** Calling create_page without a strategy brief, which ties the page to a goal in our content plan and to its role in the sales funnel, returns HTTP 400. The gate covers pages created through the API and MCP; creating a page in the Wagtail admin panel is outside it. 2. **No content before human approval.** Writing content while a person has not approved the strategy brief returns HTTP 409. Changes to the title, slug and SEO fields pass through this gate. 3. **No publication while the audit has errors.** Publishing returns HTTP 409 when the audit finds, among other things, facts outside the list a person approved in the strategy brief, client names covered by an NDA or no verdict from an independent critic agent. No tool on the server has a parameter that skips these gates. There are two exceptions. A correction mode for pages that are already live publishes a draft only when its audit finds nothing worse than the live version. A person can also publish a page manually in the Wagtail admin panel. ![Developer working at an ultrawide monitor with code editor in a dark office](https://ordergroup.co/media/images/cover_thumbnail_developer_workin.format-webp.width-2880.webp) ## Security: tokens, call log and a public read-only scope Part of MCP server security is built into the protocol, and the rest depends on your server. The host, the AI application the user works in, enforces user consent and policies, and a server sees neither the full conversation nor other servers. The official MCP guide "Security Best Practices" (version 2026-07-28) describes attacks such as confused deputy, token passthrough, server-side request forgery and compromise of a local MCP server. It also recommends scope minimization: ask for the smallest scope first and raise permissions only when an operation needs them. We split scopes. On the authenticated side, each request carries the token of one person or integration, and the API logs every call, so the call log shows which token did what. Our public MCP endpoint at https://ordergroup.co/mcp, running since 8 October 2026, needs no token and allows only reading and contact, through two tools: list_case_studies and submit_project_enquiry. Writing to the CMS needs a token. The endpoint is listed in the official MCP registry as [co.ordergroup/public](https://registry.modelcontextprotocol.io/v0/servers?search=co.ordergroup/public) (status active, version 1.0.0, published on 8 October 2026). The public endpoint is stateless: every call is a single POST with a JSON-RPC message, or a batch of messages, and a JSON response, with no session. An enquiry sent through MCP goes through the same function and the same rate limit as the REST contact form. The endpoint declares protocol versions 2025-06-18, 2025-03-26 and 2024-11-05. ## Why work with us as your MCP server development company: what you get and how a project runs An MCP server project with us starts with a free consultation or discovery workshop, where we go through your API, the users who will work through AI assistants and the rules agents must not break. We then design the tool list, build the MCP server on top of your API and put your rules on the server. If you want one, we add a public read-only scope. Copyright in the code we write for you passes to you with each payment, within the scope of use set in the contract, and you receive the source code. We reply to a message sent through the form within 48 hours on working days. Do you have questions? ## MCP server development - FAQ ![Łukasz Gajownik](https://ordergroup.co/media/images/T02DHCC1Z-UT420UBA7-d74022d27c3c-512.format-webp.webp) Łukasz Gajownik Head of AI & Frontend [Book a free consultation](https://ordergroup.co/contact-us/) ### What does an MCP server development service include? Designing the tools on top of your existing API, token authentication, a call log and server-side gates for the rules agents must not break. Where it makes sense, it also includes a public read-only scope and a listing in the official MCP registry, as we did for our own server. ### How do we choose an MCP server development company? Ask to see a server running in production and check four things: whether the rules agents must not break live on the server as response codes and validation, whether every request carries its own token and lands in a call log, whether a public scope is separate from the authenticated one, and who owns the code. With us, copyright passes to you with each payment and you receive the source code. ### Do we need an existing API to build an MCP server? An existing API makes the job simpler. Our own MCP server is a thin layer over the CMS REST API: every tool calls an API endpoint, so the MCP server does not duplicate the API's validation and permissions. ### How do you stop an AI agent from doing something it should not? With gates on the server. On our MCP server, creating a page without a strategy brief returns HTTP 400, and writing content before the brief is approved or publishing with audit errors returns HTTP 409. No tool has a parameter that skips them, and the prompt only explains the rules. ### How do you authenticate AI agents on an MCP server? Each request carries the token of one person or integration in the Authorization: Bearer header, and the API validates and logs it. Our public endpoint needs no token, but it allows only reading and contact. ### Which AI assistants can use our MCP server? Any client that supports MCP. According to Anthropic's December 2025 announcement, that includes ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code. Claude, Anthropic's own assistant, has supported MCP since the protocol was introduced in November 2024. ### Can an MCP server be public? Yes, with a narrow scope. Our public endpoint at https://ordergroup.co/mcp needs no token and offers two tools, one for reading our case studies and one for sending an enquiry. ### Have you built MCP servers for clients? Not yet. We have run our own production MCP server since July 2026 and our public endpoint since October 2026. A client project starts with a free consultation about your API and the rules agents must follow. ### Which transport does an MCP server use? Our CMS server uses stdio when a developer runs it locally and the streamable HTTP transport in production. Our public endpoint is stateless: each call is a single POST with a JSON-RPC message, or a batch of messages, and gets a JSON response, with no session between calls. ### Is your public MCP endpoint listed in the official MCP registry? Yes. It is listed as [co.ordergroup/public](https://registry.modelcontextprotocol.io/v0/servers?search=co.ordergroup/public), with status active and version 1.0.0, published on 8 October 2026. It declares protocol versions 2025-06-18, 2025-03-26 and 2024-11-05. ### What does MCP server security depend on? Partly on the protocol: the host enforces user consent and policies, and a server sees neither the full conversation nor other servers. The rest is the server's job. The official "Security Best Practices" guide lists attacks such as confused deputy and token passthrough and recommends asking for the smallest scope first. ### Who owns the code of the MCP server you build for us? You do. Copyright in the code we write for you passes to you with each payment, within the scope of use set in the contract, and you receive the source code. ### What happens to a project enquiry an AI assistant sends through MCP? On our public endpoint, the submit_project_enquiry tool sends the enquiry through the same function and the same rate limit as the REST contact form. We reply within 48 hours on working days. ![Developer with headphones coding at desktop monitor in an open office](https://ordergroup.co/media/images/Image_1_3kejLC8_Y69T2Sz.format-webp.width-2880.webp) ## An MCP server for your product, from the tool list to the rules the server enforces. Your message goes to ![Filip Szamborski](https://ordergroup.co/media/images/Filip_dTWHyBo.2e16d0ba.fill-432x432.format-webp.webp) Filip Szamborski Co-founder & CEO [](https://www.linkedin.com/in/filip-szamborski/) SO FAR WE HAVE WORKED WITH BRANDS LIKE: - [![RAW Cyber](https://ordergroup.co/media/images/raw-cyber-mono_M2DWvZf_pHEQtjP.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/raw-cyber-custom-android-os/) - [![Skyfri](https://ordergroup.co/media/images/skyfri-mono_KGicBgp.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/skyfri-solar-asset-management-platform/) - ![Spacestor](https://ordergroup.co/media/images/spacestor-mono_woFaKhf.max-208x64.format-webp.webp) - [![Zeronest](https://ordergroup.co/media/images/zeronest-mono_BqSPQJQ_2nGxsSc.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/zeronest-solar-panel-monitoring-app/) - ![AASA24](https://ordergroup.co/media/images/aasa24-mono.max-208x64.format-webp.webp) Thank you for your message. We read every message ourselves and get back to you within 48 hrs on business days. Something urgent? [hello@ordergroup.co](mailto:hello@ordergroup.co)