Interestingly most people in the comments talk about implementing an MCP server, while few talk about implementing an MCP client (as in actually using MCP for a specific purpose)
In my company I use it to manage multiple Microsoft 365 clients. I control the server and keys for clients and manage azure roles, each of my technicians get permissions based on their azure role in my tenant.
In another company I work with, they use it to manage multiple tenants in a construction software platform.
Practical example: I can now ask Claude to grab the new user request that was emailed to me, and create the user and email the client back with details.
I think something people miss about "just using the API" is that managing keys and git repos is not something regular people do. The learning curve is too steep.
MCP SSO/OAuth and DCR means non-technical users can just paste in a URL and sign in, like they do with everything else.
>Practical example: I can now ask Claude to grab the new user request that was emailed to me, and create the user and email the client back with details.
This sounds 100% absolutely horrible. If we had to reserve some small fraction of responsibilities that should not be delegated to an LLM, granting access control in a multi-tenant system has got to be up there in a top 5, along with controlling a nuke. If you are automating this, you hold nothing sacred.
I'm sure there's "more two it", but are you telling me with a straight face that you take an email sent by someone in your org requesting more access for themselves or an employee, then you copy and paste that in an LLM, and then take the output config files and feed it into your security system to grant them access?
> I think something people miss about "just using the API" is that managing keys and git repos is not something regular people do. The learning curve is too steep.
MCP SSO/OAuth and DCR means non-technical users can just paste in a URL and sign in, like they do with everything else.
Maybe that's cool? I can't imagine how that would apply to managing access control in a multi-tenant scenario, if a user cannot handle a secret string, then they shouldn't be managing access control in a multi-tenant platform.
The actually only sane part of this worflow is whatever is preventing you from completely automating this. There's some ticket system that requires some kind of manual intervention to mark as solved. The moment you start using an RPA system (like what OAI is releasing with v6), to mark tickets as closed, and these requests are fulfilled without human intervention, you have officially gone off the deep end.
I patiently and diligently await the day of reckoning
