Model Context Protocol (MCP) in Production: Architecture Patterns for Enterprise Agent Integration

In the early era of Large Language Model development, every enterprise built custom, ad-hoc integrations for function calling. A team integrating PostgreSQL, Jira, GitHub, and Slack had to maintain bespoke wrappers for OpenAI, Anthropic, and LangChain.

The Model Context Protocol (MCP), open-sourced by Anthropic and rapidly adopted by Microsoft, GitHub, and major IDEs, is the USB-C of Agentic AI. It establishes a standardized protocol over JSON-RPC 2.0 that decouples LLM applications (clients) from data sources and tools (servers).

MCP Core Topology: The Client-Host-Server Triad

An MCP architecture consists of three distinct participants:

1. MCP Host: The coordinating application (e.g., Claude Desktop, Antigravity IDE, Cursor, custom FastAPI service).
2. MCP Client: A protocol client that manages bidirectional connections and sessions with multiple servers.
3. MCP Server: A lightweight, isolated service exposing three primitive capabilities:
   • Prompts: Pre-configured prompt templates for user workflows.
   • Resources: Read-only contextual data (files, database tables, git commit history).
   • Tools: Executable functions (e.g. deploy_container, query_postgresql, execute_sql).

   ┌────────────────────────────────────────────────────────┐
   │                       MCP Host                         │
   │  ┌──────────────┐                 ┌─────────────────┐  │
   │  │  LLM Engine  │<───────────────>│   MCP Client    │  │
   │  └──────────────┘                 └────────┬────────┘  │
   └────────────────────────────────────────────┼───────────┘
                                                │ JSON-RPC (stdio / SSE)
                 ┌──────────────────────────────┼──────────────────────────────┐
                 ▼                              ▼                              ▼
     ┌──────────────────────┐       ┌──────────────────────┐       ┌──────────────────────┐
     │  PostgreSQL Server   │       │    GitHub Actions    │       │    Kubernetes Pods   │
     │  Resources & Queries │       │  Issue & PR Tools    │       │  Deployment Tools    │
     └──────────────────────┘       └──────────────────────┘       └──────────────────────┘

Building a Production MCP Server in TypeScript

Here is a hardened enterprise MCP server exposing database diagnostics over standard I/O (stdio):

import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import {
    CallToolRequestSchema,
    ListToolsRequestSchema,
    Tool
} from '@modelcontextprotocol/sdk/types.js';

const server = new Server(
    { name: 'enterprise-postgres-mcp', version: '1.2.0' },
    { capabilities: { tools: {}, resources: {} } }
);

// Define available tools with strict JSON Schema
const QUERY_AUDIT_TOOL: Tool = {
    name: 'run_performance_audit',
    description: 'Inspects long-running database transactions and lock contentions.',
    inputSchema: {
        type: 'object',
        properties: {
            minDurationMs: { type: 'number', description: 'Threshold duration in milliseconds' },
            limit: { type: 'number', default: 10 }
        },
        required: ['minDurationMs']
    }
};

server.setRequestHandler(ListToolsRequestSchema, async () => ({
    tools: [QUERY_AUDIT_TOOL]
}));

server.setRequestHandler(CallToolRequestSchema, async (request) => {
    if (request.params.name === 'run_performance_audit') {
        const { minDurationMs, limit } = request.params.arguments as { minDurationMs: number; limit: number };
        
        // Execute sandboxed telemetry query
        const mockAuditResults = [
            { pid: 14201, query: 'SELECT * FROM orders ORDER BY created_at DESC', duration_ms: 4500, state: 'active' }
        ];

        return {
            content: [{
                type: 'text',
                text: JSON.stringify({ threshold: minDurationMs, count: mockAuditResults.length, results: mockAuditResults }, null, 2)
            }]
        };
    }
    throw new Error(`Unknown tool: ${request.params.name}`);
});

async function main() {
    const transport = new StdioServerTransport();
    await server.connect(transport);
    console.error('🚀 Enterprise MCP Server running on stdio');
}
main().catch(console.error);

Security Boundaries in Production MCP

Deploying MCP in enterprise environments introduces critical zero-trust security requirements:

1. Transport Isolation: For local desktop agents, stdio provides process-level isolation. For distributed cloud architectures, Server-Sent Events (SSE) with mutual TLS (mTLS) and OAuth2 Bearer tokens should be enforced.
2. Schema Invariant Checking: Never trust agent inputs. Validate all arguments using libraries like Zod to prevent SQL injection or path traversal attacks.
3. Human-in-the-Loop Confirmation: High-impact tools (delete_record, scale_down_cluster) must emit an interactive authorization challenge to the host application before executing.