MCP server development
MCP Server Development: Connect Claude or ChatGPT to Your Systems
I am Shahid Malla, a freelance AI agent and full-stack developer with 13+ years of experience. MCP server development with me gives Claude, ChatGPT or your own AI agent a small, tested set of tools for your CRM, database, WHMCS or internal API: read-only by default, signed in per user, every write confirmed and logged.
Free scoping call of about 30 minutes · written quote within one business day · two weeks of support after delivery
By Shahid Malla, AI agent and AI chat developer, full-stack developer · Updated
What is MCP server development?
MCP server development is building the program that lets an AI application, such as Claude, ChatGPT or your own agent, read from and act on your systems through the Model Context Protocol. The official introduction calls MCP "an open-source standard for connecting AI applications to external systems."
The server sits between the AI and your CRM, database or API. It holds the credentials, decides which actions exist and returns only the data each action needs. Per the specification, a server can offer tools ("Functions for the AI model to execute"), resources ("Context and data, for the user or the AI model to use") and prompts. Business servers are mostly tools. For the agent itself, see AI agent development.
What can a custom MCP server connect Claude or ChatGPT to?
Anything with an API or a database the server can reach. The common ones, with the access I start each on:
| System | Example tools | Starting access |
|---|---|---|
| CRM | find_contact, list_open_deals | Read-only API user; notes added later, behind a confirmation |
| SQL database | Named queries over views, such as orders_for_customer | Read-only database user, row limits, no free-form SQL |
| WHMCS | Client, invoice and ticket lookups through the External API | Its own API role with "Get" actions only, from one allowed IP |
| Internal API | One tool per endpoint people actually need | Each user's OAuth token or a service account, scoped to those endpoints |
To connect Claude to your database, the read-only user matters most. Anthropic's Claude Code MCP docs say: "Use a read-only database user in the connection string so the queries Claude runs can't modify data." For WHMCS, my WHMCS MCP server guide compares the packages that already exist.
Which AI clients can use your MCP server?
Claude, Claude Code, ChatGPT and the OpenAI Agents SDK all accept MCP servers, but reach them differently. Per each vendor's documentation on 25 October 2026:
| Client | How it is added | What your server needs |
|---|---|---|
| Claude (web, Desktop, Cowork, mobile) | Custom connector by URL; on Team and Enterprise an Owner adds it, then members connect | A URL "reachable over the public internet from Anthropic's IP ranges"; per-user OAuth, a header credential or no sign-in |
| Claude Code | claude mcp add --transport http <name> <url>, or a stdio command; .mcp.json shares it with a team | An HTTP endpoint or a launch command |
| ChatGPT | ChatGPT Plugins, then Add custom MCP server; workspace policies apply | Public HTTPS with streamable HTTP, or OpenAI's Secure MCP Tunnel |
| OpenAI Agents SDK | In code, over Streamable HTTP, SSE or stdio, or as a hosted MCP tool | A reachable transport; per-tool approval and tool filters are built in |
A ChatGPT connector is, in OpenAI's current docs, a custom MCP server created as a plugin. Anthropic's connector guide says "Claude implements a subset of the MCP specification", with limits of about 150,000 characters per tool result and 240 seconds per call on claude.ai and Desktop. I test in every client you use.
Should your MCP server run locally or remotely?
Locally over stdio when one person uses it on their own computer; remotely over Streamable HTTP when a team, claude.ai or ChatGPT needs it. The transports page defines stdio as messages "over the standard streams of a client-launched subprocess" and Streamable HTTP as "each message is an HTTP POST to a single MCP endpoint".
- stdio: private and simple, with credentials taken "from the environment", per the authorization spec. claude.ai and Cowork cannot use it, and ChatGPT reaches it only through the Secure MCP Tunnel.
- Streamable HTTP: one deployment for many people, with hosting, HTTPS and sign-in. Servers "MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks". Claude connects "from Anthropic's cloud infrastructure, rather than from your local device", so a server behind a VPN must allow Anthropic's IP ranges.
How do you keep an MCP server secure?
Assume the model can be talked into anything, and make the server and your systems refuse. The specification admits "MCP itself cannot enforce these security principles at the protocol level," so these controls live in the server and its credentials.
| Control | What I build | Source |
|---|---|---|
| Least privilege | One narrow tool per job, strict input schema, no catch-all query tool | Tools spec: servers MUST "Implement proper access controls" |
| Read-only by default | A read-only database user or API role, so writes are impossible, not just discouraged | OpenAI: writes can occur "even if the MCP server has tagged the action as read only" |
| Confirmation for writes | A write creates a pending action that a person confirms on the server | Tools spec: "there SHOULD always be a human in the loop with the ability to deny tool invocations" |
| Per-user sign-in | OAuth, so each person reaches only their own data; tokens checked, never passed through | Authorization spec: servers "MUST NOT accept or transit any other tokens"; Anthropic: a shared key "gives everyone who uses it that credential's access" |
| Secrets out of prompts | Credentials in the server's secret store, never in tool text, results or URLs | Authorization spec: tokens "MUST NOT be included in the URI query string" |
| Logging | Every call, user, tool, redacted arguments and refusal | Tools spec: "Log tool usage for audit purposes" |
| Rate limits | Per user and per tool, with timeouts and row caps | Tools spec: servers MUST "Rate limit tool invocations" |
| Prompt injection | Ticket, email and web text comes back as trimmed data; a session that reads it gets no write tools | OpenAI: "an attacker could send you a customer support request with a prompt injection attack" |
Tool labels do not replace this: clients "MUST consider tool annotations to be untrusted unless they come from trusted servers," so the credential, not the label, blocks a write.
What should you ask any MCP server developer before hiring?
Ask where a write is stopped when the model gets it wrong:
- Which tools can change data?
- Does each tool run with the user's own credentials or one shared key?
- If the model is tricked, what blocks the write: the client, the server or your API?
- What is logged, and for how long?
- How will prompt injection be tested?
- How do we revoke all access in one step?
What will I not build into an MCP server?
Anything that gives a model more power than a careful new employee would get on day one:
- A free-form SQL or shell tool against production.
- Tools that move money, delete records or change access without a person confirming each call.
- Token passthrough, which the MCP security best practices call "an anti-pattern".
- A custom server where the vendor's official one fits. OpenAI advises to "choose official servers hosted by the service providers themselves", and I will say when that is cheaper.
I give no accuracy figure in advance; tool choice is measured on your own prompts.
What MCP and AI experience do I bring?
If you are deciding whether to hire an MCP developer like me, here is my proof, and where it stops.
- MagizAI: I am founder and CEO of MagizAI, an AI chatbot and live chat with a free WHMCS addon module. According to MagizAI's MCP page, it connects to a company's own MCP servers, calls only the tools the owner ticks ("Anything unticked is never called"), and holds Sensitive tools "until the visitor types back a six-digit code". It also publishes small PHP, WordPress and Next.js starter servers.
- WHMCS: 200+ custom modules and a published guide to WHMCS MCP servers. I have not published a WHMCS MCP server of my own.
- Claude Code: I build client software with it daily, connecting agents to documentation and test databases through MCP servers with read-only or test-only access. See hire a Claude Code developer.
I work remotely, for example for RealBytes (a client portal for an Australian hosting provider), Krunus (a website for a UK hosting provider, connected to cPanel) and Chargewise (a Next.js store shipping across the United States and Canada). None were MCP projects; they are the kind of systems an MCP server sits in front of.
How much does MCP server development cost?
A fixed quote after a free scoping call of about 30 minutes, written within one business day, or $55 to $65 an hour. No packages: the price depends on how many tools write, the sign-in method, which clients must work and how well your API is documented. Hosting and model usage are separate costs on your own accounts. If a plain integration through automation development would do the job for less, I will say so. Terms are on how I work.
Disclosure: Claude is a trademark of Anthropic; ChatGPT is a product of OpenAI. I am not affiliated with either company or the MCP project. I founded MagizAI and WHMCSPilot and am CTO at ElySpace. Documentation linked here was read on 25 October 2026.
Who this is for
- SaaS companies whose customers want to use the product from inside Claude or ChatGPT
- Teams that want staff to ask a CRM, database or internal API questions in plain language, without giving an AI a database password
- Hosting companies that want an AI client to read WHMCS data under a narrow API role
- Developers with an MCP server that works on a laptop and now needs sign-in, logging and a public endpoint
What is included
- A tool list: each tool mapped to one real question or task, with a strict input schema and only the fields it needs to return
- A server in TypeScript on the official MCP SDK, or with Laravel MCP inside your Laravel app, over Streamable HTTP, stdio or both
- Per-user sign-in with OAuth where the client supports it, or a scoped token for internal use, never a shared admin key
- A dedicated, least-privilege credential for your API or database, read-only by default
- Confirmation steps for every tool that writes, enforced on the server and not only in the AI client's dialog
- An audit log of every call and refusal, rate limits per user and tool, and timeouts
- Tests with the MCP Inspector and in each client you use, including a planted prompt injection test
- Deployment, a written handover covering tools, scopes and how to revoke access, and two weeks of support
How the work runs
-
1
Scoping call
About 30 minutes on which AI clients you use, which systems they should reach, which questions and actions matter, and who signs in. A written scope and fixed quote follow within one business day, including the tools the server will not have.
-
2
Tool and access design
I list every tool with its inputs, outputs, risk level and the credential behind it, and set up a read-only database user or API role on your side.
-
3
Build on staging
The server runs against a staging copy or test data first, never production. Read tools come first, with daily progress updates.
-
4
Test in the real clients
Raw calls in the MCP Inspector, then Claude, ChatGPT or your agent with a set of real prompts, plus a test where planted text tries to trigger a tool it should not.
-
5
Pilot, then writes
A small group uses the read tools in production. Write tools are added one at a time, each behind a confirmation step, once the logs look right.
-
6
Hand over
Code in your repository, deployment notes, the tool and scope list, how to rotate or revoke credentials, and two weeks of support.
Recent work
All case studies →-
My product (founder and CEO)
MagizAI
My own product: AI chatbot and live chat for websites
-
Client project
RealBytes
Client portal for an Australian hosting provider
-
Client project
Krunus
Website and order flow for a UK hosting provider
-
Client project
Chargewise
Next.js online store for smart 12V battery chargers
Guides on this topic
All guides →-
WHMCS MCP Server: Connect Claude or ChatGPT to WHMCS Safely
What a WHMCS MCP server does, the Marketplace modules, open-source packages and hosted service that exist today, which WHMCS API actions to expose first, and a safety model built on API roles, approvals and audit logs.
-
AI Chatbot vs AI Agent: Which Does Your Business Need?
A chatbot answers from your content and an agent calls tools that change things. How tool calls work per the provider docs, the workflow option between them, how each is billed, and a decision table.
-
My Claude Code Workflow for Client Projects: Steps and Guardrails
How I run Claude Code, with Codex as a second agent, on paid client projects: the spec, the rules files, plan mode, worktrees, hooks, reviews, MCP limits, staging and the handover your team keeps.
-
How Much Does It Cost to Build an AI Agent or AI Chatbot?
Build hours by cost driver, monthly token bills worked out with Anthropic and OpenAI prices read on 15 October 2026, the costs people forget, a quote checklist and when not to build.
Frequently asked questions
What is an MCP server, in plain terms?
An MCP server is a small program that offers an AI application a list of actions, called tools, plus optional data and prompt templates, using the open Model Context Protocol. The AI client, such as Claude or ChatGPT, reads the list and asks the server to run a tool when a request needs one. The server holds the credentials and runs the action against your system. The model never logs in to your CRM, database or API, and can only use the tools the server offers.
Can one MCP server work with both Claude and ChatGPT?
Usually, yes, if it is a remote server over Streamable HTTP with a sign-in method both clients accept. Claude connects from Anthropic's cloud, so the URL must be reachable from Anthropic's IP ranges. ChatGPT needs a public HTTPS endpoint or OpenAI's Secure MCP Tunnel. Anthropic's documentation says Claude implements a subset of the specification, with its own size and timeout limits, so I test the same server in every client you plan to use before launch.
How do you connect Claude to a database safely?
Through a server with named, read-only queries rather than open SQL. The server connects with a read-only database user, which Anthropic's Claude Code documentation also recommends so that the queries Claude runs can't modify data. Each tool runs one parameterized query over a view, returns a capped number of rows and leaves out columns such as password hashes, card data and private notes. If writes are ever needed, they go through your application's API with a confirmation step, not straight into tables.
Do we need an MCP server or a normal API integration?
If a task runs the same way every time, such as copying new orders into a CRM, a normal integration or webhook is cheaper and easier to test. An MCP server pays off when people ask varied questions in an AI client, or when you want one tool layer that Claude, ChatGPT and your own agent can all use. Often the answer is both: an integration for the fixed jobs and a read-only MCP server for the questions.
Can you build an MCP server for WHMCS?
Yes. I have built 200+ custom WHMCS modules and work with the External API and its API roles. I have not published a WHMCS MCP server of my own, and several modules and open-source packages already exist, so I start by checking whether one fits. When your products, approval rules or data limits are unusual, I build a custom server on its own read-only API role first. See custom WHMCS module development.
Are you affiliated with Anthropic, OpenAI or the MCP project?
No. I am an independent developer who builds with Claude, the OpenAI API and MCP. I am not affiliated with, certified by or endorsed by Anthropic, OpenAI or the Model Context Protocol project. I name their products only to say which clients a server will work with, and every product detail on this page links to the vendor's own documentation.
What do you hand over at the end?
The source code in your repository, the deployed server, a list of every tool with its inputs, outputs, credential and risk level, the OAuth or token setup, and the steps to revoke access or rotate credentials. You also get the test prompts used to check which tool the model picks, the prompt injection test, and two weeks of support after delivery.
Related services
-
AI Agent Development: Hire an AI Agent Developer
AI agent development for hosting and SaaS teams: agents that answer tickets from your knowledge base, update W...
-
Hire Laravel Developer: Apps, Filament Panels, Upgrades and AI
Hire Laravel developer Shahid Malla: 13+ years, 900+ projects. New apps, Filament admin panels, APIs, Laravel...
-
Hire Claude Code Developer: Claude Code Expert for SaaS and CRM
Hire Claude Code developer or Claude Code expert Shahid Malla: 13+ years, 900+ projects. SaaS, CRMs and apps b...
-
WHMCS API Integration and Automation
I connect WHMCS to your CRM, Slack or Telegram, SMS, accounting and control panels with the API, localAPI() an...
Ready to talk about your project?
You deal with me personally from the first message to the handover. Choose the way that suits you; I reply within one business day.