Enterprise MCP patterns
MCP makes it easy for one person to give an AI client access to a system. Doing that for a whole company raises different questions: who sees what, who can change what, how access ends, and where the data goes. These are the patterns OrgRelay is built around.
They apply whether staff reach OrgRelay through Claude Code, Claude Desktop, Codex or OrgRelay's own app. Owners can read the same ideas without the technical detail on orgrelay.com/security.
1. One gateway in front of many systems
Without a gateway, each employee configures each vendor's MCP server with their own credentials, and nobody can answer "who can read the ERP?". With OrgRelay in front:
- The company's credentials for Shopify, Odoo or QuickBooks live once, encrypted, on the company's machine. See the connector directory.
- Staff connect their client to OrgRelay only, with a personal token.
- Every call to every system lands in one activity log.
Vendor MCP servers can sit behind OrgRelay too, as third-party MCP connections.
2. Read-only by default for sensitive areas
Finance and HR data is where accidental exposure hurts most.
- Grant accounting connectors such as QuickBooks Online or Kingdee to the finance department only.
- Switch off write tools you do not need. A finance team that only reports never needs
finance.create_invoice. - Keep salaries and ID numbers out of tools entirely, as the security requirements recommend to connector developers.
Permissions are checked on the server before a request leaves OrgRelay. An employee whose role is not granted a connector never sees its tools, and asking the AI to "try anyway" does nothing.
3. Every change goes through a person
MCP clients can call tools without asking, depending on their settings. OrgRelay does not rely on that. Any tool that changes data creates an approval request instead of running, and there is no MCP tool that approves. The mechanics are on approvals and write tools; the reasoning is on human-in-the-loop.
4. One account and one token per person
- Each person uses their own Claude or Codex account. Shared accounts make the audit trail meaningless, and OrgRelay's account rules do not allow them.
- OrgRelay tokens are personal, expire after 30 to 365 days, and are capped at 10 active per person and 60 calls per minute each.
- For central billing, give staff seats on a Team plan rather than sharing one login.
5. Offboarding in one click
When someone leaves or changes role:
| Action in OrgRelay | Effect on MCP |
|---|---|
| Suspend the person | All tokens and OAuth grants revoked immediately |
| Remove a folder from their access | Applies to MCP on the next call |
| Change their department | Connectors and skills follow the new department at once |
| Revoke one OAuth grant | That client loses access; others keep working |
6. Decide where data may go
In MCP mode, tool results become part of the conversation in the person's AI client and travel to that provider: Anthropic for Claude, OpenAI for Codex. For many teams that is acceptable. For some it is not.
| Need | Pattern |
|---|---|
| Data must stay in-country | Switch MCP off for those people; they use OrgRelay's app with a domestic model |
| Data must not leave the building | OrgRelay's app with a local model on the Mac mini |
| Mixed | MCP for sales and marketing, OrgRelay's app for finance |
7. Audit what the AI did
The owner's Admin → MCP page shows who uses MCP, from which client, how often, and the last 100 calls with permission denials highlighted. The full activity log tags MCP calls with the client name, so they can be filtered alongside web and app activity. Connector developers can add their own trail by logging orgrelay/actor and the approval id, as described on MCP transport.
8. Remote access without exposing the office
OrgRelay is reached through a Cloudflare Tunnel, so no inbound port is opened. If the company uses Cloudflare Access for the web app, bypass only /mcp (and oauth plus .well-known for claude.ai connectors). Those paths are protected by OrgRelay's own tokens and sign-in. Details on the MCP overview.
9. Teach the AI the company's way of working
Instructions belong in Agent Skills, reviewed by the owner and granted by department, rather than in each person's prompt. Staff using Claude or Codex receive the same skills through MCP.
A starting configuration
For a 30-person trading company starting out:
- MCP on for managers and sales; off for finance until reviewed.
- Store and CRM connectors granted to sales, read tools only.
- Accounting connector granted to finance in OrgRelay's app only.
- All write tools left on but approval-gated; review the approval log weekly.
- Token lifetime 90 days.
Adjust after a month of reading the activity log.
Common questions
Can phrasing get around permissions? No. Enforcement is on the server.
When someone leaves? Suspend them; every token and grant is revoked.
Keeping data in-country? MCP off for those people; OrgRelay's app with a domestic or local model.
Next
- Set up clients: Claude Code, Codex, Cursor.
- Connect the systems: the connector directory, or build one with the quickstart.
Related pages
- Connector spec: manifest fields, naming, errors, paging and versioning.
- Authentication: tokens, OAuth client credentials and rotation.
- Self-test tool: the self-test tool and what each check means.
- Code templates: download the developer kit and four templates.