# MCP for a Small Business: The Starter

What the Model Context Protocol is without the jargon, whether you need it at all, the short list
worth installing, and the three ways to install it.

Version 1.1, 2026-08-22. Every figure measured that day.
Free to copy, fork and reuse. Attribution appreciated, not required.
Source article: https://jwatte.com/blog/mcp-servers-for-small-business/

---

## 0. What it is, in plain terms

An AI assistant on its own can only read what you paste into it. **MCP is a standard way to give
it tools**, so it can look something up or do something in another system without you copying and
pasting.

A **server** is a small program that offers a set of tools. A **client** is the assistant that
calls them. The protocol is just the agreement between them, so anybody's server works with
anybody's assistant.

That is the whole idea. Everything else is detail.

Four things worth knowing before you read anything else about it:

* **It is young.** The specification was substantially rewritten on 28 July 2026, which
  deprecated several features every older tutorial describes. If a guide is more than a few
  months old, it is describing an older protocol.
* **The official registry lists 24,240 servers and reviews none of them.** It hosts metadata, not
  code, and its own moderation policy says it will not remove a server for having a security
  vulnerability.
* **The registry is also not where vendors publish.** Of nineteen live first-party servers found
  by asking the vendors directly, ten were absent from the registry entirely. Start at your
  vendor's documentation, not at the index.
* **A server runs with whatever credentials you give it.** That is the trade. Everything in the
  vetting checklist follows from that one sentence.

---

## 1. Do you even need one? The honest test

Answer these before installing anything.

```
[ ] Have I used the assistant for a month WITHOUT tools and hit a specific wall?
[ ] Can I name the wall in one sentence?
[ ] Is the thing behind that wall a system I pay a vendor for?
[ ] Does that vendor publish its own MCP server? (Check the vendor's docs, not a list.)
[ ] Would a scheduled script or a CLI tool solve it just as well?
```

**If you cannot answer the first two, stop.** Installing tools to find a use for them is how
people end up with nine servers, a slower assistant and a credential inventory they cannot
recite.

**If the answer to the last one is yes, do that instead.** Anthropic's own cost guidance
recommends preferring a CLI tool where one exists, because a command-line tool adds nothing to
the assistant's context, while a server adds at least its tool names.

---

## 2. The short list

Verified on 22 August 2026 by sending a real protocol handshake to each vendor's own address, not
by reading a directory. Re-check with `check-mcp-endpoints.mjs` before you rely on it.

### Runs a first-party server, and is in the official registry

| Tool | Endpoint | Worth it if |
|---|---|---|
| Stripe | `mcp.stripe.com` | You take payments and want to ask questions about them |
| PayPal | `mcp.paypal.com` | Same, on PayPal |
| Notion | `mcp.notion.com` | Your documentation or CRM lives in Notion |
| Cloudflare | `mcp.cloudflare.com` | You manage your own DNS or hosting |
| Airtable | `mcp.airtable.com` | Airtable is your operational database |
| Atlassian | `mcp.atlassian.com` | Jira or Confluence is where the work lives |
| Linear | `mcp.linear.app` | You track issues in Linear |
| Wix | `mcp.wix.com` | Your site is on Wix |
| Webflow | `mcp.webflow.com` | Your site is on Webflow |

### Runs a first-party server that the registry does NOT list

These are real, live and published by the vendor. Searching the official registry will not find
them, which is exactly why the registry is the wrong place to start.

| Tool | Endpoint |
|---|---|
| Square | `mcp.squareup.com` |
| Canva | `mcp.canva.com` |
| Xero | `mcp.xero.com` |
| Sentry | `mcp.sentry.dev` |
| Calendly | `mcp.calendly.com` |
| Asana | `mcp.asana.com` |
| HubSpot | `mcp.hubspot.com/anthropic` |
| Pipedrive | `mcp.pipedrive.com` |
| Intercom | `mcp.intercom.com` |
| Squarespace | `mcp.squarespace.com` |

### Can you connect it WITHOUT granting write access?

The real question. These are the permission scopes each server declares, read on 22 August 2026.

| Vendor | Scopes | Read | Write | Notes |
|---|---|---|---|---|
| Square | 49 | 26 | 23 | Paired per resource: take `ORDERS_READ`, leave `ORDERS_WRITE` |
| Canva | 16 | 10 | 6 | Same pattern |
| **Xero** | **9** | **4** | **0** | **No write scope exists. See below.** |
| Airtable | 7 | 4 | 3 | Cleanly paired |
| Calendly | 2 | 1 | 1 | `mcp:scheduling:read` / `:write` |
| Linear | 2 | 1 | 1 | Literally `read` and `write` |
| Sentry | 4 | 1 | 3 | `org:read`, then three write scopes. Look twice. |
| Notion | 1 | 0 | 0 | One scope named `default`. All or nothing. |
| Asana | 1 | 0 | 0 | Also `default` |
| Wix | 1 | 0 | 0 | Only `offline_access` |
| Stripe, PayPal, Cloudflare, HubSpot, Webflow | 0 | | | Document published, no scopes in it |
| Pipedrive, Intercom, Atlassian, Squarespace | | | | No document |

**A blank row is not "no control".** It means this one metadata file is empty. Stripe, for
instance, scopes through restricted API keys plus dashboard controls set separately for live mode
and sandbox. Read the vendor's own permission documentation before concluding anything.

**Sentry is the one to look at twice.** Three of its four scopes are write scopes.

**If you check this yourself, fetch both locations.** Square publishes two of these documents and
they disagree: the one tied to the endpoint path lists nothing, the one at the domain root lists
all forty nine. `check-mcp-endpoints.mjs` checks both and takes the richer one.

### Xero: the bookkeeping server that cannot write

Worth its own heading, because bookkeeping is the thing everyone is right to be nervous about.

Xero's hosted server offers nine scopes. Four are ordinary sign-in. The rest are
`accounting.settings`, `accounting.invoices.read`, `accounting.reports.aged.read`,
`accounting.reports.balancesheet.read` and `accounting.reports.profitandloss.read`. Its
authorisation server is `identity.xero.com`.

**There is no write scope on offer at all.** Not "choose read-only", not "read-only if you ask".
An agent connected to it can read your profit and loss, balance sheet, aged receivables and
invoices, and cannot change any of them, because Xero did not build that door.

One wrinkle: Xero's developer FAQ describes a *local* server you run yourself and says
development experience is required. Read only that page and you would conclude a small business
cannot use Xero this way. The hosted endpoint says otherwise. Neither the registry nor the
vendor's docs is reliable alone; the endpoint is what is actually true.

### No public server found, as of 22 August 2026

QuickBooks, Mailchimp, WooCommerce, Zoho, Zendesk, Freshworks, Twilio.

Two notes on that list. `mcp.intuit.com` does exist, but it refuses every request and its DNS
record points at a host named `gatewaysimulatorser.e2e.api.a.intuit.com`, which is a test
environment rather than a product. And "no server found" means nothing answered at the address
you would guess. Shopify, for example, uses a per-store endpoint rather than one central address,
so a hostname probe reads as absent when it is not.

Community servers exist for most of the missing ones. **Think hard before using one for anything
holding customer or financial data.** A community accounting server is a program written by a
stranger, which you would be handing a token that can read every invoice you have ever issued,
listed in a registry that has stated in writing that it will not remove it if it turns out to be
vulnerable.

Some of those projects are good. You have no practical way to tell which from the outside.

---

## 3. Remote beats local, almost always

Two kinds of server:

| | Remote | Local |
|---|---|---|
| Runs on | The vendor's servers | Your machine |
| Authenticates with | OAuth, in a browser | A secret you paste into a config file |
| You are trusting | The vendor you already pay | Whoever wrote the code, plus their dependencies |
| Secret sitting on your laptop | No | Yes, usually a long-lived one |

**Prefer remote.** Every server in the short list above is remote, on the vendor's own domain.
You sign in the same way you sign in to anything else, and there is no API key living in a text
file on your laptop until you leave the company.

Use local servers for things that must touch your own machine, such as a filesystem tool, and
understand that you are running somebody's code.

### The third kind: servers that want nothing from you

Squarespace's server takes no credential at all. It has two tools, both about searching for a
domain to buy, and one of them returns a purchase link. That is a storefront with a protocol in
front of it.

There is no token to leak, which is genuinely safer in one dimension. What you accept instead is
a vendor putting product suggestions in front of your assistant while you are deciding something.
Neither risk is worse. Just know which one you took.

---

## 4. Installing, three ways

### The least technical: Claude Desktop connectors

Click, sign in through the vendor's normal OAuth screen, done. Same flow as connecting any app to
any other app. If this covers what you need, stop here.

### Claude Code, one command

```bash
claude mcp add <name> --transport http <url>
```

Scopes decide who gets it:

| Scope | Flag | Who sees it |
|---|---|---|
| Local | default | Only you, only this project |
| User | `--scope user` | Only you, everywhere |
| Project | `--scope project` | Everyone on the team, via a committed `.mcp.json` |

**Project scope requires each teammate to approve the server before it connects.** That approval
step is deliberate. Do not look for a way around it; it is the only thing standing between a
cloned repository and a server you never agreed to.

Check your work:

```bash
claude mcp list
claude mcp get <name>
```

A server that failed to connect is not the same as one that is working, and the conversation will
not always make that obvious.

### By hand

Editing the config file directly. Only if you have a reason.

---

## 5. What it costs you

**Context, less than it used to.** Tool definitions used to load at session start for every
connected server. Tool search is now on by default: only tool names and server instructions load
up front, and full definitions are fetched when needed. Adding servers is cheaper than it was.

Two caveats: tool search is not supported on Microsoft Foundry deployments hosted on Azure, which
force tools to load up front; and a CLI tool still costs less than any server, because it adds
nothing at all.

**Attention.** Every server is a thing to keep updated, a credential to rotate and a decision to
revisit. Three servers is a Saturday morning twice a year. Twelve is a job.

---

## 6. A sensible first ninety days

**Month one.** No servers. Use the assistant, notice where you actually get stuck, write it down.

**Month two.** Install exactly one, first-party, remote, read-only if the vendor offers it. Use it
for a month before adding anything else.

**Month three.** Add a second only if you can say what the first one saved you. If you cannot,
remove the first one instead.

**Every six months, ongoing.** Read your own list. For each server: do I still use it, is the
credential still scoped correctly, has the project been updated this year. Remove anything that
fails.

That cadence sounds slow. It is the difference between a tool you understand and a pile of
software with tokens in it.

---

## 7. Three shapes of business, three answers

**Two-person online shop.** Stripe, so you can ask about yesterday's charges without exporting a
spreadsheet, and Xero, which normally I would tell you to leave until last and here recommend
without much hesitation, because its hosted server offers no write scope at all.

**Twelve-person services firm.** Pipedrive or HubSpot for deals, Intercom for support, Notion for
docs, Calendly for scheduling. All four run first-party servers and only Notion is in the
registry, so an owner searching the official index would wrongly conclude none exist. Start with
Notion, lowest stakes and highest payoff. Add the CRM second, read-only.

**Forty-person shop with engineers.** Sentry, Linear, Atlassian, Cloudflare. This is the only one
of the three where a community server is a defensible risk, because somebody there can actually
read the code. Even then, not for anything holding customer or financial data.

The pattern is the same in all three: small number, vendor source, read-only default.

---

Companion files at https://jwatte.com/downloads/

* `mcp-server-vetting-checklist.md` : the ten-second first-party test, the full checklist, and what to do when a server misbehaves
* `check-mcp-endpoints.mjs` : the probe used to produce the tables above, so you can re-run it yourself

Written by J.A. Watte. https://jwatte.com