Security

Your Business Central MCP server should be read-only until it can't be

Jun 5, 2026 5 min read

The Business Central MCP server is GA-adjacent and the pitch writes itself: connect Claude or Copilot Studio, read and write ERP data in natural language, no custom API. The connection is the boring part. You've just handed a promptable, nondeterministic actor a write path to your ledger — and the only thing standing between it and a posted document is how you configured it.