
Rupa Tiwari📖 TL;DR An MCP agent is four things: a model, two or three MCP servers, a system prompt, and a...
📖 TL;DR
- An MCP agent is four things: a model, two or three MCP servers, a system prompt, and a guardrail on writes.
- Sales → HubSpot or Salesforce + Slack + Calendar. Marketing → Ahrefs or Semrush + Exa + Notion.
- Social media → X and TikTok have official ad MCP servers. Organic posting still needs Zapier or your own server.
- Support → Stripe + Slack + Linear. Data → PostHog or Amplitude + your warehouse. Engineering → GitHub + Sentry + Linear.
- Three servers is the ceiling for most agents. Past that, tool-selection accuracy falls off a cliff.
- Model choice is a cost decision, not a quality one. Haiku for routing, Sonnet for reasoning, Opus for long chains.
Every team I talk to wants the same thing from MCP. Not a protocol tour — an agent that does their actual job.
The sales lead wants call prep. The marketer wants a content brief that cites real keyword data. The support lead wants refund triage.
These are all the same build. Only the servers change.
So this post is organised the way you actually think about it: by role. For each one I list the MCP servers worth connecting, the hosted URLs, a model recommendation, and example prompts that work on day one.
I have kept every URL genuine. Where a service has no official hosted MCP server, I say so instead of inventing one.
Strip away the frameworks and every MCP agent is the same four things.
| Part | What it decides | Where teams get it wrong |
|---|---|---|
| Model | How well it picks the right tool | Paying for a frontier model to do lookups |
| MCP servers | What the agent can actually reach | Connecting eight when three would do |
| System prompt | The job, the tone, the limits | Vague role text with no stop rules |
| Write guardrail | What it may change without asking | Skipped entirely until something breaks |
The fourth row is the one people skip. An agent with a Stripe token can issue refunds. An agent with a CRM token can overwrite deal stages.
I put one line in every system prompt I write: propose writes, never execute them, until I say go.
The instinct is to connect everything. Resist it.
Every connected server injects its full tool schema into the model's context on every single request. A large server like GitHub runs to roughly 18,000 tokens on its own.
Connect six of those and you have burned your context window before the user types a word. Worse, tool-selection accuracy drops as near-identical tool descriptions pile up.
I use a three-server rule, and each server plays a distinct part:
Record, context, channel. Almost every useful agent below is that shape.
Sales reps lose hours to two chores. Researching a prospect before a call, and updating the CRM after it.
Both are pure context assembly. That is exactly what an MCP agent is good at.
| MCP server | Hosted URL | What it unlocks |
|---|---|---|
| HubSpot | https://mcp.hubspot.com |
Deals, contacts, pipeline stages, notes |
| Salesforce | Per-org URL from your instance | Opportunities, accounts, custom objects |
| Clay | https://mcp.clay.earth/mcp |
Enrichment, firmographics, contact finding |
| Exa | https://mcp.exa.ai/mcp |
Live web research on the account |
| Google Calendar | https://calendarmcp.googleapis.com/mcp/v1 |
Who you are meeting, and when |
| Slack | https://mcp.slack.com/mcp |
Delivery channel for the brief |
My recommended build: Calendar + HubSpot + Exa. The agent reads tomorrow's meetings, pulls each account's CRM history, and researches recent news.
Model: Claude Sonnet 5. Call prep involves synthesis across three sources, which is where cheaper models start dropping details.
Prompts that work immediately:
Watch the write scope. A HubSpot token with write access lets the agent change deal stages. Start read-only, and add writes once you trust its judgement.
Most AI content workflows fail for one reason. The model has no idea what people actually search for.
It guesses at keywords, invents volumes, and produces a brief that reads well and ranks nowhere.
Connecting a real SEO data source fixes that in one step.
| MCP server | Hosted URL | Best for |
|---|---|---|
| Ahrefs | https://api.ahrefs.com/mcp/mcp |
Backlinks, keyword difficulty |
| Semrush | https://mcp.semrush.com/v1/mcp |
Competitor gaps, position tracking |
| DataForSEO | https://mcp.dataforseo.com/mcp |
Raw SERP data, cheapest per call |
| OpenSEO | https://app.openseo.so/mcp |
AI-search visibility tracking |
| Firecrawl | https://mcp.firecrawl.dev/v2/mcp |
Scraping competitor pages to markdown |
| Notion | https://mcp.notion.com/mcp |
Where the finished brief lands |
| Webflow / Sanity |
https://mcp.webflow.com/mcp / https://mcp.sanity.io
|
Publishing straight to the CMS |
| Canva | https://mcp.canva.com/mcp |
Generating on-brand visuals |
My recommended build: Ahrefs + Exa + Notion. Keyword truth, live SERP context, and a place to file the output.
Model: Sonnet 5, or a stronger reasoning model when the brief spans a dozen competitor pages.
Prompts worth stealing:
Before you hand an SEO server real API credits, connect it in the browser and read its tool list. Ahrefs and Semrush both meter by call, and a chatty agent burns quota fast.
This is the role with the biggest gap between expectation and reality, so let me be blunt about it.
Paid social has excellent official MCP coverage. Organic posting mostly does not.
X and TikTok both ship real hosted MCP servers, and both are aimed at advertising. There is no official hosted MCP server for scheduling an Instagram carousel or a LinkedIn post.
| Platform | MCP URL | Scope |
|---|---|---|
| X (Twitter) | https://api.x.com/mcp |
Official, ads and API surface |
| TikTok for Business | https://business-api.tiktok.com/open_mcp/tt-ads-mcp-flat |
Official, campaign management |
| Meta Ads (Pipeboard) | https://meta-ads.mcp.pipeboard.co/ |
Third-party, Facebook and Instagram ads |
| Apify | https://mcp.apify.com |
Scraping public profiles and competitor feeds |
| Canva | https://mcp.canva.com/mcp |
Generating post creative from a brand template |
| Zapier | Per-account URL you generate | The practical bridge to organic posting |
Zapier is the honest answer for scheduling. You pick the actions you want exposed, Zapier generates a private MCP endpoint, and the agent calls those actions as tools.
It is not elegant. It works today, and it covers the platforms nobody else does.
Model: Sonnet-class for ad analysis. A cheap model is plenty if the agent only drafts copy and reads metrics.
Prompts to start with:
Support tickets arrive with no context. The agent's job is to attach it before a human opens the thread.
Who is this customer? What plan are they on? Did they just get charged twice? Is this a known bug?
Three servers answer all four questions.
https://mcp.stripe.com/ for subscription state, invoices and failed payments.https://mcp.slack.com/mcp to read the support channel and post the summary back.https://mcp.linear.app/sse to check whether the bug is already filed.Model: Claude Haiku 4.5. Triage is high-volume and low-ambiguity, which is the cheapest model's sweet spot.
This is also the role where read-only really matters. A support agent should never issue a refund on its own initiative.
⚠️ Prompt injection is a live risk here. Ticket text is untrusted input written by strangers. An agent that reads tickets and holds a Stripe write token is one crafted message away from a bad day. Keep the refund tool out of its reach.
Every analytics team has the same queue. Twenty people asking questions that are one SQL query away from an answer.
An MCP agent with warehouse access clears most of that queue, as long as you keep it read-only.
| Category | Servers |
|---|---|
| Product analytics | PostHog https://mcp.posthog.com/mcp, Amplitude https://mcp.amplitude.com/mcp
|
| Warehouses | BigQuery https://bigquery.googleapis.com/mcp; Snowflake and ClickHouse run locally |
| App databases | Neon https://mcp.neon.tech/sse, MongoDB via its local server |
| Notebooks | Hex https://app.hex.tech/mcp
|
My recommended build: one analytics source, one warehouse, Slack for delivery.
Model: a strong reasoning model. SQL generation against an unfamiliar schema is where the cheaper tiers start guessing at column names.
Non-negotiable: connect with a read-only role. Not a role you promise to use carefully — one the database will not let write.
Engineering has the deepest MCP coverage of any function. Almost every developer tool shipped a server first.
| Server | URL | Agent job |
|---|---|---|
| GitHub | https://api.githubcopilot.com/mcp/ |
PR review, release notes, stale-branch sweeps |
| Sentry | https://mcp.sentry.dev/mcp |
Error triage, regression spotting |
| Linear | https://mcp.linear.app/sse |
Sprint state, ticket creation |
| Vercel | https://mcp.vercel.com |
Deploy status, build log reading |
| Cloudflare | https://mcp.cloudflare.com/mcp |
Workers, DNS, edge config |
| Figma | https://mcp.figma.com/mcp |
Design-to-code handoff |
| Context7 | https://mcp.context7.com/mcp |
Current library docs, no auth needed |
| Datadog | https://mcp.datadoghq.com/api/unstable/mcp-server/mcp |
Live metrics and logs during an incident |
| PagerDuty | https://mcp.pagerduty.com/mcp |
On-call context and incident timelines |
Three builds cover most of what engineering teams ask for:
Model: the top tier. Code reasoning across a diff is the one place a frontier model consistently earns its cost.
Only the GitHub server is free to connect with no key. Context7 is the other one, which makes the pair a good first test.
Project managers spend their week converting one format into another. Meeting notes into tickets. Tickets into status updates.
That is mechanical work, and it is the easiest agent on this list to get right.
https://mcp.asana.com/mcp
https://mcp.monday.com/mcp
https://mcp.atlassian.com/v1/mcp
https://mcp.airtable.com/mcp
https://calendarmcp.googleapis.com/mcp/v1
My recommended build: Calendar + Notion + Slack. It reads yesterday's meetings, finds the notes, and drafts the action items.
Model: Haiku 4.5. Summarising and restructuring text does not need a reasoning model, and this agent runs daily.
Finance questions are usually simple and always urgent. Which subscriptions failed to renew this week?
Payment platforms have solid MCP coverage, so this one is quick to stand up.
https://mcp.stripe.com/ for subscriptions, invoices, disputes and payouts.https://mcp.paypal.com/mcp for orders and refunds.https://mcp.cashfree.com/mcp for India-first payment flows.Join Stripe to Linear and Slack, and a spike in failed payments becomes a tracked issue rather than a Slack message nobody actions.
Model: Sonnet-class. Money questions deserve a model that checks its arithmetic against the tool output rather than guessing.
Teams overthink this. Model choice is a cost decision far more often than a quality one.
A triage agent reading tickets does not need frontier reasoning. A code-review agent across a 900-line diff does.
| Tier | Use it for |
|---|---|
| Nano / Flash | One-tool lookups, routing, Zapier actions |
| Claude Haiku 4.5 | Support triage, standups, daily digests |
| Claude Sonnet 5 | The default. Sales, marketing, finance |
| Claude Sonnet 4.6 | Three servers, long tool chains, SQL |
| Claude Opus 5 | Code review, incident analysis, hard chains |
Start one tier below what you think you need. If the agent picks the wrong tool or drops a step, move up one and compare.
Here is the failure mode I see most. Someone wires four servers into an agent, it behaves strangely, and they blame the model.
Nine times out of ten the server was the problem. It exposed three tools instead of the twelve the docs promised, or its auth silently failed.
So before any URL above goes into an agent, run it through four checks:
This runs in the browser with no install. Paste any remote MCP URL, complete the OAuth flow or add a bearer token, and inspect the tool list and raw JSON-RPC responses before you commit.
1. Connecting every server you can find. Three is the working ceiling. Each extra one costs context and accuracy.
2. Giving write access on day one. Run read-only for a week. Read the transcripts. Then decide which writes it has earned.
3. Using one generic system prompt for every agent. A sales agent and a support agent need different stop rules, not the same helpful-assistant boilerplate.
4. Skipping the token scope review. A GitHub token with repo scope reaches every private repository you can. Scope it down before it goes in.
5. Never evaluating the thing. If you cannot say whether last week's version was better, you are guessing.
The pattern repeats across every role here. One system of record, one context source, one delivery channel, and a model matched to the difficulty.
Sales gets a CRM and a calendar. Marketing gets keyword data. Support gets billing state. Engineering gets the repo and the error tracker.
Pick the role that loses the most hours this week and build that one. Test every server in the browser before you trust it with a token.
Originally published on MCP Playground.