mcp · ai-assistant · business-central · governance · 3 min read

A Business Central MCP server: what an AI assistant can (and cannot) do with your ERP

What the Model Context Protocol changes for Dynamics 365 Business Central, how a governed MCP server exposes customers, items, availability and documents to an AI assistant, and where the limits are.

Last updated September 12, 2026 · Plur-e Team

Quick answer

An MCP server for Business Central exposes ERP data and actions as tools that an AI assistant can call — search customers, check availability by bin, list open orders, draft a quote. A governed server runs every call under the signed-in user's Entra ID identity, separates read from write tools, requires an MCP Write or Post role before it writes, and logs everything. It does not replace posting rules, permissions or your partner's judgement.

Everyone has seen a demo where an assistant "talks to the ERP". The Model Context Protocol (MCP) is what makes that repeatable instead of a one-off integration. This post explains what an MCP server for Business Central actually is, what Plur-e builds, and the boundaries we keep.

MCP in one paragraph

MCP is an open protocol in which a client (a desktop app, an IDE, a web AI platform, or your own agent) connects to a server that publishes tools with JSON schemas. The model decides which tool to call, the server executes it against the real system and returns structured results. The same server works with any MCP client.

What a Business Central server exposes

Grouped by area, with a scope per tool:

Area	Read	Write
Customers	search, card, ledger	—
Items	search, availability by location and bin, ledger	—
Sales	list documents	create quote, create order (Write role)
Purchasing	open POs, vendor	—
Warehouse	activities, bin contents, count discrepancies	—
Documents	posted invoice/shipment/receipt	—

A typical conversation: "Which open sales orders for Customer example 1 are short on stock at MAIN?" → list_sales_documents → get_availability per line → a table with the shortfalls and links to the records.

What an AI assistant cannot do

Bypass permissions. Calls run as the user; if the user cannot see a customer, neither can the assistant.
Write without a role. Write tools require an MCP Write or Post role on that area; without it, the tool returns scope_denied — posting routines stay in Business Central.
Invent numbers. Results carry the record URL so answers can be checked; the server returns data, not opinions.
Train on your data. Prompts and results are processed by your AI provider's API under its commercial terms and are not used to train models by default.

Why this beats a custom chatbot

A custom bot is one integration for one UI. An MCP server is one integration for every MCP client — and the tool schemas double as documentation. When Business Central adds a field, you update one tool.

Where to start

A two-hour discovery workshop identifies the ten questions your team asks Business Central every day. A pilot of a few weeks ships the read tools for those questions; writes come after the audit trail is in place.

See it on your Business Central

Start the 30-day trial from AppSource or book a demo with a Dynamics specialist.

Start free trial Book a demo