Business teams wanted to analyze live operational data with Claude, ChatGPT, and custom agents. The source was a production SQL Server database behind a legacy ERP. Giving general-purpose AI direct database access would have been useful, but unnecessarily risky and difficult to govern.
The architecture
I built a Model Context Protocol layer that made the ERP legible through a narrow set of purpose-built, read-only tools. The safety boundary was architectural: the interface could inspect and query approved data, but it could not create, update, or delete production records.
What I built
The system exposed more than 25 tools for schema discovery, SQL inspection, dependency analysis, ERP data-dictionary lookup, and governed data access. It also included:
- Read-only database controls
- Query validation and SQL-injection prevention
- Active Directory authentication with no plaintext credentials
- A dynamically generated data dictionary for obscure ERP tables and fields
- Git-managed queries, skills, and operating instructions
The outcome
BI, Finance, and IT could use familiar AI tools to answer real business questions with current ERP data. The interface reduced dependence on proprietary schema knowledge and removed IT as the only path to every new query, while keeping the production boundary clear.
Why this is signature work
It is a compact example of my broader operating style: understand the legacy system deeply, wrap it in a safer modern interface, and expand access without surrendering control. Governance was not paperwork added after the build. It was the shape of the build.