The client needed to ship a Model Context Protocol (MCP) server quickly within a large, established API ecosystem. MCP is a standard that allows AI agents to securely access tools, data, and services through well-defined interfaces, making it easier for applications to integrate AI capabilities without custom, one-off integrations.

PubGENIUS partnered with their engineering team to design and implement a secure, scalable MCP server that integrated seamlessly with their existing systems, without disrupting current workflows.

The problem was not building an MCP server from scratch, it was making one work inside an established enterprise environment. 

Key challenges included:

1. Legacy API integration The MCP server needed to interface with a large, existing API surface rather than a greenfield system, requiring careful alignment with existing patterns and constraints.

2. Authentication and authorization alignment Any solution had to fit into the client’s current identity, permissioning, and security models without introducing inconsistencies.

3. Security and scalability concerns As a new entry point into critical systems, the MCP server had to be designed to avoid becoming an attack vector while remaining scalable under future usage. Security considerations, such as those in the OWASP MCP Security Top 10 guide, informed our design and risk assessment.

4. An evolving MCP specification The implementation needed to support today’s MCP requirements while remaining adaptable as the MCP specification continues to evolve.

We worked closely with the client’s internal engineering team as an augmentation partner rather than an external handoff.

Our approach focused on reducing risk early:

• Collaborated directly with the existing team to understand system constraints and operational realities

• Clarified MCP requirements and mapped them onto the client’s current API and security architecture

• Identified blockers and gaps in the existing implementation that could impact MCP compatibility

• Planned a phased implementation that prioritized correctness, security, and long-term maintainability

This ensured the MCP server could be delivered quickly without creating technical debt or architectural dead ends.

The MCP server was designed as a thin, deliberate translation layer rather than a rewrite of existing systems.

Key product decisions included:

• Translation-based architecture

The MCP server sits between MCP clients and the client’s existing APIs, translating MCP requests into internal API calls without duplicating business logic.

• Standards-compliant authentication designed for an evolving MCP standard

We implemented a standards-compliant OAuth authentication system aligned with the MCP specification and integrated it directly into the client’s existing authentication infrastructure. The model was designed with forward compatibility in mind, supporting MCP-specific requirements today while providing a clear path to adopt future evolutions of the standard, such as Client ID Metadata Documents (CIMDs), without requiring a redesign of the core system.

• User-scoped entitlements

Permissions were simplified by scoping entitlements directly to users, instead of defining a new permissioning model, reducing complexity and making it easier for application developers to reason about access control.

• Enabling self-documenting, integration-ready APIs

We helped evolve the client’s internal APIs toward a self-documenting model using the OpenAPI Specification, improving clarity, consistency, and usability across their API surface. This not only enabled seamless MCP integration, but also created a stronger foundation for future internal and external integrations without increasing maintenance overhead.

This design allowed the MCP server to integrate cleanly with existing systems while remaining flexible enough for future changes.

✔️ Delivered a future-proof MCP interface integrated into a complex enterprise API ecosystem

✔️ Provided a clear upgrade path as the MCP standard evolves

✔️ Reduced cognitive load for application developers by abstracting MCP complexity behind a simple integration layer

✔️ Enabled internal teams to build new MCP-powered features without reworking core infrastructure.