Connecting MCP servers lets a data agent read context from the tools a team already uses and write its analyses back into them, provided each connection is scoped, instructed and kept separate from the governed path that produces the numbers.
Ka Ling Wu
Co-Founder & CEO, Upsolve AI
10 min
The Complete Agent Stack · Part 07 of 14 · Agent harness layer
This guide is one part of a 14-part series on what a production data agent needs, from the data model it reads to the agent that keeps it accurate. Each part stands on its own, and they build on each other in order.
← Previous: Part 06: AI Agent Harness · Next: Part 08: AI-Generated Dashboards →
A data agent can produce a correct, well-explained answer and still leave the most tedious step to a person. Someone copies the chart into a doc or a ticket, and the context of how the number was produced gets lost on the way. Meanwhile, context that would have improved the answer, such as a launch plan or an incident write-up, sits in tools the agent cannot reach.
The Model Context Protocol (MCP) closes that gap without custom integration work for each tool. This guide covers what an MCP server adds to a data agent, how to connect one step by step, and the security decisions that come with letting an agent act in other systems. Its companion, MCP vs SQL for Data Agents, explains why cross-source numbers should come from SQL instead.
Key Takeaways
Most team tools already have a server. When Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation, it counted more than 10,000 active public MCP servers and adoption by ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code.
Remote servers authenticate with OAuth 2.1. The MCP specification requires servers to accept only tokens issued for them, which rules out passing one credential through to other services.
A person should be able to stop any tool call. The specification says there should always be a human in the loop with the ability to deny tool invocations, and that clients must treat tool annotations as untrusted unless the server is trusted.
Fewer tools usually work better. Anthropic's engineers write that "more tools don't always lead to better outcomes," and Notion's MCP server alone lists more than 30 tools, so allowlists and per-connection instructions matter.
The 45-second version:
What Is an MCP Server in a Data Agent?
MCP is an open standard for connecting AI applications to external systems (MCP documentation). The specification defines three roles that exchange JSON-RPC 2.0 messages: hosts, which are the LLM applications; clients, which are connectors inside the host; and servers, which provide context and capabilities (MCP specification). Servers can offer resources (context and data), prompts (templated messages and workflows) and tools (functions the model can execute).
In a data agent, the agent is the host. Each connected tool, such as Notion, Linear or GitHub, runs an MCP server, and the agent holds one client connection per server. When the agent decides it needs a tool, it calls that tool through the client, and the result returns to the model as content it can reason over.
Putting a data agent inside Claude reverses the roles: the data agent becomes the server and Claude the host, a route covered in the guide on data analysis in Claude with MCP. This guide covers the agent as a client.
What Should a Data Agent Use MCP Servers For?
A data agent's core job is answering questions from governed, structured data. MCP connections extend that job in three useful directions and one direction that causes trouble.
Publishing analyses where the team works
The most immediate use is writing results somewhere durable. An agent that can create a page in a docs tool or post a summary to a project tool turns an answer in a chat window into a document a team can review, comment on and find later.
Pulling in context that is not in the warehouse
Many questions benefit from context that never reaches a database: a product spec that explains why a metric changed, a ticket describing a known data issue, or a pull request that altered how an event is tracked. Read access to those tools lets the agent cite that context next to the numbers.
Turning findings into follow-up work
When an analysis finds something that needs action, such as a drop in activation after a release, the agent can open a ticket with the evidence attached.
What to keep out of MCP
MCP is a poor fit for combining numbers from several sources, because the model ends up matching and aggregating records inside its context window. For analytics across tools, the sibling guide on MCP vs SQL for data agents sets out the case for cross-source SQL.
How to Connect an MCP Server to a Data Agent
Before setup, it helps to compare the main ways of giving an agent access to other tools.
Approach | Build effort | What the agent sees | Risk when something goes wrong | Upkeep |
|---|---|---|---|---|
Custom integration per tool | High: write and host code for each API | Only the operations you built | Limited to what you built | You maintain each integration as APIs change |
MCP server with every tool allowed | Low: add a URL and sign in | Every tool the provider exposes | Broad: any tool, including writes, can be called | The provider maintains the server |
MCP server with an allowlist and an instruction | Low, plus a few minutes of curation | Only the tools you approve, with guidance on when to use them | Narrow and easier to audit | The provider maintains the server; you review the allowlist |
The third approach keeps most of the speed of MCP while reducing the surface area. The steps below follow it.
1. Choose the server and copy its URL
Many SaaS vendors host remote MCP servers that a client reaches by URL. Notion, for example, runs "a remote MCP server hosted by Notion" that lets authorised clients read and update content the user can access (Notion, MCP documentation). Prefer the vendor's official server where one exists. Local servers are a different category: the MCP security guidance notes that they run on the user's machine with the client's privileges and can execute arbitrary commands if they come from an untrusted source (MCP Security Best Practices).
2. Authenticate with OAuth
For remote servers, the MCP authorisation flow is based on OAuth 2.1. The client discovers the server's authorisation server, sends the user through a consent screen in the browser, and receives an access token tied to that specific server (MCP specification: Authorization). Servers must reject tokens issued for any other resource. The security guidance also recommends a least-privilege model, starting with a minimal set of scopes and requesting more only when a privileged operation is first attempted.
3. Allow only the tools the agent needs
A server usually exposes more tools than one use case needs. Notion's supported-tools page lists more than 30, from search and page creation to database and comment management (Notion, Supported tools). Anthropic's guidance on tool design warns that "too many tools or overlapping tools can also distract agents from pursuing efficient strategies" (Anthropic, Writing effective tools for agents).
Collisions are a second reason to curate. The MCP specification notes that tool names are only unique within a server, so two connected servers can each expose a search tool, and clients should disambiguate them (MCP specification: Tools). Blocking tools the agent does not need, particularly write and delete operations it should never perform, reduces both confusion and risk. Enabled tool definitions also occupy the model's context, a budget explained in our guide to context windows.
4. Write an instruction for each connection
Tool descriptions come from the provider and explain what each tool does. They cannot say when your agent should use it or where results belong. Anthropic's engineers recommend describing a tool the way "you would describe your tool to a new hire on your team." A one-line instruction per connection does that job for your context: "Use this to save finished analyses in the Sales section of Notion" tells the agent both the purpose and the destination. This is context engineering on a small scale, a discipline covered in our review of context engineering tools.
5. Test with real questions and review the trace
Ask the questions people will actually ask, then check which tools the agent called, with what arguments, and in what order. The specification recommends that clients log tool usage for audit purposes. Reviewing those traces regularly is part of AI agent observability, and it is a direct way to find a missing instruction or a tool that should be blocked.
What Are the Security Risks of MCP Servers for Data Agents?
Each connection gives the agent new ways to read and act. Four risks deserve explicit decisions before rollout.
Prompt injection across servers
Simon Willison describes a "lethal trifecta" for agents: access to private data, exposure to untrusted content, and the ability to communicate externally (Willison, The lethal trifecta for AI agents). A data agent has private data by design. If it can also read a document an outsider can edit and write to a tool that sends messages, an instruction hidden in that document could direct it to leak data. Willison notes that MCP "encourages users to mix and match tools from different sources." Stripe's own MCP documentation advises caution when combining its server with others to avoid prompt injection (Stripe, MCP documentation).
Over-broad scopes
The MCP security guidance warns that tokens carrying broad scopes enlarge the impact of a leak, and lists wildcard or "full-access" scopes among common mistakes (MCP Security Best Practices). Connect with an account whose access matches what the agent needs.
Writes without review
The specification says applications should make clear which tools are exposed, show when tools are invoked, and present confirmation prompts so a human stays in the loop. Some providers enforce this themselves: Stripe requires human confirmation before certain write actions such as refunds. For a data agent, read and publish actions are usually low risk, while anything that changes records in another system deserves a confirmation step or a block.
Governance that does not travel through MCP
An MCP connection carries its own credential and permissions. It does not inherit the row-level rules that decide which tenant sees which rows in your data model. Those rules should stay where the agent's data queries run, enforced before any query reaches the database, as described in the guide on row-level security for AI agents.
How Upsolve Approaches MCP Connections
Upsolve MCP Connections let a team attach any MCP server reachable by URL to an Upsolve agent. Upsolve agents previously worked only with structured sources such as Postgres, ClickHouse, Snowflake and BigQuery. As agents went into production, teams asked to connect MCP sources so the agent could read and write other kinds of data. The agent still answers from governed warehouse data, and questions still run through the data model and row-level security.
In project settings, you paste the server URL and add a one-line instruction. You connect through standard OAuth, then allow all of the server's tools or block the ones you do not want the agent to use. Supported servers include Notion, Linear, GitHub, PostHog and any other tool that exposes an MCP server.
The product demo uses a sample project with Olympic medal data. A Notion connection is added with the instruction "Use this to save analyses in Notion docs," authenticated through OAuth, and left with all tools allowed. A sample user restricted to Japan by row-level security then asks which athletes have won the most medals. The agent retrieves golden examples and schema, writes the SQL and returns a chart of Japanese athletes only, led by a 13-medal winner in the sample data. Asked to write a detailed analysis into a Sales page in Notion, the agent first runs Notion's search tool to confirm the page exists, then runs the page creation tool and returns a link to the new page.
As Serguei Balanovich, Upsolve, summarised in the demo, the connector brings external tools into an Upsolve agent so that teams can "read and write data that is not stored in your structured databases." The connection sits in the agent harness alongside skills and memory, covered in the guide to the AI agent harness. For cross-source numbers, the Data Plane handles the SQL, and MCP Connections handle the actions.
Frequently Asked Questions
What is an MCP server for an AI agent?
An MCP server is a service that exposes tools, resources and prompts to AI applications through the Model Context Protocol, an open standard. For an agent, the most important part is usually its tools: functions such as searching a workspace, reading a page or creating a ticket. The agent connects to the server as a client, discovers the available tools, and calls them when a task needs them. Remote servers are reached by URL and typically use OAuth for authentication, so the agent acts with the permissions of the account that signed in.
How do I connect an MCP server to my data agent?
Find the official remote server URL for the tool, add it to your agent's configuration, and complete the OAuth sign-in so the agent receives a token for that server. Then review the list of tools the server exposes and block the ones the agent does not need, especially write or delete operations. Add a short instruction that tells the agent when to use the connection and where to put results. Finally, test with real questions and read the tool-call trace to confirm the agent chose the right tools in the right order.
Can a data agent write analyses to Notion or Linear?
Yes, if it is connected to those tools' MCP servers with write tools allowed. A typical flow has the agent answer the question from governed data first, then search the destination workspace to find the right page or project, then create the page or issue with the analysis attached. Instructions make this reliable by naming the destination and the format. Teams should decide which write tools are allowed and whether actions that change existing records, as opposed to creating new pages, need a person to confirm them.
Is it safe to connect MCP servers to a data agent?
It can be safe if you set deliberate limits. Use official remote servers, authenticate with OAuth using an account that has only the access the agent needs, and allow only the tools the use case requires. Be careful when one agent can read untrusted content and also send data outside the organisation, because that combination enables prompt injection attacks. Keep row-level security enforced in the data layer rather than relying on each MCP connection, and log tool calls so that every action can be reviewed afterwards.
Should I use MCP for analytics across tools?
MCP is the right choice for actions and extra context. For numbers that combine several sources, use SQL over a modelled data layer. When an agent pulls records from several MCP servers, it has to match and aggregate them inside its context window, where tool output limits and duplicate records lead to errors that look precise. A query engine does that work reliably and leaves an auditable query behind. The MCP vs SQL guide explains the trade-offs in detail.
How many MCP servers should a data agent connect to?
Connect as few servers as your use cases require, with as few tools enabled as possible. Every connected server adds tool definitions the model must read and choose between, and overlapping tools, such as two different search tools, make wrong choices more likely. A practical approach is to start with one or two connections tied to specific workflows, such as publishing analyses to a docs tool and opening tickets in a project tool, then add more only when a recurring request needs them.
Sources
Model Context Protocol: What is the Model Context Protocol (MCP)? https://modelcontextprotocol.io/docs/getting-started/intro
Model Context Protocol: Specification (overview, roles, features and security principles). https://modelcontextprotocol.io/specification/latest
Model Context Protocol: Specification, Tools. https://modelcontextprotocol.io/specification/2026-07-28/server/tools
Model Context Protocol: Specification, Authorization. https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
Model Context Protocol: Security Best Practices. https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
Anthropic: Donating the Model Context Protocol and establishing the Agentic AI Foundation. https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation
Anthropic Engineering (Aizawa): Writing effective tools for agents, with agents. https://www.anthropic.com/engineering/writing-tools-for-agents
Notion Developers: Notion MCP and Supported tools. https://developers.notion.com/docs/mcp and https://developers.notion.com/guides/mcp/mcp-supported-tools
Simon Willison: The lethal trifecta for AI agents: private data, untrusted content, and external communication. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Stripe Documentation: Model Context Protocol (MCP). https://docs.stripe.com/mcp
MCP Connections are part of The Complete Agent Stack series, which covers the ontology, harness, distribution and improvement loop behind accurate data agents. To connect your first MCP server to a governed data agent, start free at upsolve.ai with 2,000 free AI credits, or talk to our team.
Try Upsolve for Embedded Dashboards & AI Insights
Embed dashboards and AI insights directly into your product, with no heavy engineering required.
Fast setup
Built for SaaS products
30‑day free trial
