How to connect your AI to your logistics operation (MCP)

What is MCP?

MCP, the Model Context Protocol, is an open-source standard for connecting AI applications to external systems. Through it, an AI application such as Claude or ChatGPT can reach data sources such as files and databases, tools such as search engines and calculators, and workflows such as specialised prompts. The MCP project compares it to a USB-C port for AI applications: one standard way to connect, instead of a separate custom link for every system.

An MCP server is the program that offers the tools and data. An MCP client is the AI application that uses them. For a logistics company, the server is the place where transport, warehouse and customs tools would be offered to the AI of your choice.

How does an AI sign in to an MCP server?

Over HTTP, the MCP specification defines an authorization mechanism based on OAuth 2.1 (it refers to an IETF draft of OAuth 2.1). Authorization is optional in MCP, but a server that needs to protect its data should use it. The MCP server acts as an OAuth resource server, the AI client acts as an OAuth client, and a separate authorization server talks to the user and issues access tokens.

In practice the flow has four steps:

• The client calls the server without a token and is told that authorization is required.
• The client finds the authorization server from the metadata that the MCP server publishes.
• The user is sent to the authorization server, signs in and approves. The client uses PKCE and names the MCP server as the resource the token is for.
• The client receives an access token and sends it with every request. The server accepts only tokens that were issued for itself.

The practical meaning for a company: the AI is never given a password, the user decides on a screen they recognise, and the server can refuse any token that was not issued for it.

What makes it safe to use in logistics?

OAuth answers the question of who is asking. It does not say what the AI may do inside a logistics system; that has to be built into the product. Three rules matter most:

• Role-based tools: the AI sees only the tools that the user’s role and company allow, not the whole catalogue.
• Human approval: anything that changes something passes through a person. The AI drafts, the person decides.
• Audit and a way out: every call is recorded (who, which tool, when), and the company can cut the connection at any moment.

Company isolation is the fourth rule. One company’s AI must not see another company’s records, so company and role are checked again on every call, not only at sign-in. The data security guide covers this in more detail.

Which actions should an AI be allowed to take?

A simple way to decide is to sort actions into three levels:

• Read: answering questions from the company’s data within the user’s role, for example which trucks are waiting at the border. Nothing changes, so it can be free.
• Suggest: preparing a draft, for example a declaration draft from an invoice. A person approves it with one tap in the application.
• Critical: payment, invoicing, release of goods from bonded storage, prices and customer master data. The AI may only open a request, and two human approval steps follow.

Moving a task to a freer level should be a conscious company decision, taken only after the AI’s accuracy on that task has been measured on the company’s own data. The guide on what AI can and cannot do in logistics explains why.

Where does the AI model come from?

MCP does not decide which model you use. A company can use model access supplied by the product vendor, bring its own key from a model provider, or run open models on its own premises or on a server reserved for it. The security rules above should be identical in all three cases. The choice of server is covered in the server choice guide.

What should you ask before connecting an AI?

Whoever offers an MCP server to your AI should be able to answer these questions plainly:

• How does the user sign in, and does the AI ever see a password?
• Which tools will the AI see, and who decides that per role?
• Does anything that changes data pass through a person?
• Is every call recorded, and can the company disconnect at once?
• Is the data of one company isolated from the data of another?

A good answer to all five is a better sign than any list of supported AI products.