What Is an MCP Server? Open Your Website and Online Store to AI Agents
AI agents no longer just read your website. They search products, check stock and make bookings. Here is what an MCP server is and when your business actually needs one.
AI agents
MCP
In our earlier post, what MCP is and how businesses can use it, we explained how to connect your own AI tools to your company data. This post flips the direction. When a customer asks ChatGPT to "find a grey corner sofa under 220 cm that can be delivered to Bursa", or asks Claude to "book a hotel near the sea in Side for 3 nights", that agent needs an MCP server to reach your website and get the right information.
Today most agents try to browse your site like a human: they read the page, guess which button does what and sometimes pick up the wrong price. MCP removes the guesswork. You define tools such as "search products", "check stock" or "get availability", and the agent calls them within the limits you set.
Below we simplify the concepts, then cover where the platforms stand, the security risks, cost and two concrete industry examples.
What is MCP? A quick definition
MCP stands for Model Context Protocol. Anthropic published it as an open standard in late 2024, and companies such as OpenAI, Google and Microsoft have since added support in their own products. The technical details are in the official MCP documentation.
Put simply, it has three parts:
- Client: the AI application, such as ChatGPT, Claude or a browser agent.
- Server: the layer running on your side that opens a door to your data and operations.
- Tools and resources: the capabilities the server offers, for example "search_products", "get_stock" or "create_booking".
An analogy: if an API is the door to your warehouse, MCP is the instruction manual hung on that door in a form AI can read. From it, the agent learns what each tool does, what information it needs and what it will return.
MCP server vs WebMCP vs NLWeb
As of 2026, three concepts are often confused. All three try to answer the same question: how can AI agents talk to a website properly?
A classic MCP server runs on the server side. The agent connects straight to your server, even when the user is not in a browser. It is the most mature option for catalogue, stock and order-status operations.
What is WebMCP? It is a browser-based approach proposed by engineers from Google and Microsoft within the W3C. Your site uses on-page JavaScript to expose tools such as "add to basket", "filter" or "pick a date" to the agent in the browser. The advantage is that the user's session and basket already live in the browser, so no extra login is needed. It is currently in early preview in Chrome and the standard is not final yet.
NLWeb is an open-source project Microsoft announced in 2025. It uses your site's schema.org data and content feeds to give your website an interface people can query in natural language. Every NLWeb installation can also act as an MCP server.
| Feature | MCP server | WebMCP | NLWeb |
|---|---|---|---|
| Where does it run? | On your server | In the user's browser | On the server, over your content data |
| Best suited to | Catalogue, stock, orders, bookings | Clicks, forms and basket actions on the site for the user | Natural-language search across content and products |
| Maturity (2026) | Widely used | Early preview | Open source, evolving |
| Session and permissions | Set up separately with OAuth | Uses the browser session | Usually public data |
For most SMEs the practical order is: fix your structured data first (schema.org, a clean product feed), then open a read-only MCP server, and add WebMCP to your site's critical flows as it matures. This ties in directly with work on visibility in AI search (GEO).
Where Shopify, WooCommerce and ikas stand
MCP support for ecommerce is moving at very different speeds from platform to platform. The information below reflects the time of writing; this area changes month to month, so always check your own platform's current documentation.
Shopify
Shopify is leading here. It offers a built-in MCP endpoint on the storefront side that answers product searches, basket questions and policy queries. It has also announced partnerships with OpenAI and Google on protocols for agent-driven shopping. If you sell in Türkiye or another specific market, confirm separately which countries the checkout side is available in.
WooCommerce
In the WordPress and WooCommerce ecosystem, MCP support has started arriving at beta level in newer releases, and there are community plugins too. Flexibility is high but plugin quality varies. Do not use a plugin on a live store without checking exactly which data it exposes.
ikas
ikas is a popular ecommerce platform in the Turkish market. At the time of writing we had not seen an official, generally available MCP server announcement from ikas. Building a custom MCP server on top of the ikas API is possible. Since the platform may announce its own solution, we recommend asking the ikas support team for the latest status. If you are still choosing a platform, our ecommerce platform comparison may help.
ChatGPT apps and Claude connectors
OpenAI introduced its Apps SDK in autumn 2025, and it is built directly on MCP. So when you build a ChatGPT app this way, you can create an experience inside ChatGPT that shows your products as cards, offers filters and opens a booking form. Apps go through OpenAI's review process before publication.
On the Claude side, users can add remote MCP servers as "custom connectors". This is especially valuable in B2B: a dealer can add your server to Claude with their own account and ask, "Which of my orders from last month have shipped?"
Security risks and authorisation
Opening an MCP server means adding a new keyhole to your business's front door. The risks need to be taken seriously.
- Prompt injection: an instruction hidden in a product review or description can push the agent towards the wrong action. Treat every piece of text the agent reads as a potential attack surface.
- Excessive permissions: giving the server full database access "to keep things simple" is the most common mistake. Each tool should touch only the data it needs to do its job.
- Personal data: if customer names, phone numbers, addresses or order history are exposed, data protection law applies. Rules differ by country (for example GDPR in the EU and UK, KVKK in Türkiye), covering privacy notices, consent and cross-border data transfers. Confirm the requirements with the official guidance in your jurisdiction and your legal adviser.
- Abuse: competitor bots pulling your price list hundreds of times a second. Rate limiting is essential.
The MCP specification defines an OAuth-based structure for authorisation. In practice, we recommend these rules:
- Public tools (product search, general availability) should be read-only.
- Tools such as dealer pricing or order history should require user login and role-based permissions.
- "Write" actions such as creating orders or bookings should finish with human approval or a redirect to a payment page as the final step.
- Every call should be logged, so you can see who used which tool, when and with which parameters.
Example 1: An MCP server for a furniture dealer catalogue
Picture a manufacturer in İnegöl, Bursa's furniture production hub, making sofas and bedroom sets. It has 60 dealers, each with its own discount rate and regional delivery time. Today dealers message on WhatsApp asking, "How many days for the Lavin corner set in anthracite fabric?" and the sales team checks the ERP and answers one by one.
An MCP server for this company could offer these tools:
- search_catalogue: product list filtered by model, size, fabric and colour (public).
- get_dealer_price: net price specific to the logged-in dealer (authorised).
- check_production_time: estimated dispatch date based on fabric stock (authorised).
- create_order_draft: a draft order awaiting the dealer's approval (authorised, human-approved).
The dealer connects Claude or ChatGPT with their own account and asks questions in plain language; the answers come straight from your system. If you already have a B2B dealer portal, the MCP server is usually built on top of its API, so you do not need to write a new system from scratch. We have also summarised typical needs in this sector on our furniture industry page.
Example 2: MCP for hotel bookings
For a 120-room hotel in Antalya, on Türkiye's Mediterranean coast, the picture is different. The main goal is for guests to book directly through the hotel's own channel via their AI assistant, without going through an intermediary platform.
The hotel's MCP server could expose:
- Room availability and prices by date and number of guests.
- Room types, views, board concept and cancellation terms.
- A link that starts the booking and sends the guest to the hotel's secure payment page.
The critical point here is that the MCP server stays in real-time sync with the channel manager and the hotel booking engine. Otherwise the agent could sell a room as "available" when it is actually full. An assistant like OSPITA AI, which talks to guests on the hotel's own website in 8 languages and guides them to a direct booking, uses the same availability data on-site; MCP is the way to open that data to agents outside the website as well.
Ready-made connector or custom MCP server?
The decision really depends on where your data lives.
A ready-made connector may be enough if:
- All your product, stock and price information sits in a single ecommerce platform,
- Your platform offers official MCP support,
- You do not have complex rules such as dealer pricing or made-to-order lead times.
You need a custom MCP server if:
- Stock is in your ERP, prices are in Excel and bookings are in a separate system,
- You have different pricing and permission rules per customer or dealer,
- You want line-by-line control over which data leaves your systems.
The technical answer to "how do you build an MCP server?" is roughly this: write the server with one of the official SDKs (TypeScript, Python and others), define the tools, connect them to your existing APIs, add OAuth, publish over HTTPS and test in clients such as ChatGPT and Claude. The real effort is not in the lines of code but in designing which tool runs under which rules. At Fietto Creative, this design stage is also where we spend the most time on our custom business software projects.
MCP server cost and timeline
It is not possible to give an exact figure; cost varies widely depending on the number of data sources, the complexity of permissions and the quality of your existing API. Still, here is an indicative framework based on what we observe in the Turkish market:
| Scope | Estimated time | Indicative cost (Turkish market) |
|---|---|---|
| Enabling and testing your platform's built-in MCP support | A few days | Low, often just setup effort |
| Read-only catalogue and stock server (single source) | 2-4 weeks | Mid-range, in the tens of thousands of TL |
| Authorised dealer pricing, orders or bookings (multiple systems) | 1-3 months | High, can reach hundreds of thousands of TL |
This table is not a price quote; it is only meant to set expectations at the decision stage. Also remember to budget on an ongoing basis for hosting, maintenance and the adjustments needed as platforms update the protocol.
Getting ready for AI agents starts with clean data, not with an MCP server. If product names, dimensions, stock and prices are inconsistent, even the best server will carry the wrong information to the agent.
Where should you start?
Three concrete steps you can take this week:
- Audit your data: are your product or room details marked up with structured data (schema.org) on your site, and is your feed up to date?
- List the 10 most frequent questions: the questions customers and dealers ask by phone and WhatsApp are the first draft of your MCP tools.
- Start with the low-risk part: a read-only catalogue search is ideal for a first pilot. Leave write access for orders and bookings to a later phase.
The way agents talk to websites is standardising fast. Businesses that prepare early will be the ones that show up with the right price and the right stock when a customer asks their AI assistant.
Frequently asked questions
Do I need to know how to code to set up an MCP server?
Switching on a ready-made platform connector usually needs no coding. A custom server that connects to your own stock, pricing or booking systems does require software development and security expertise.
Does an MCP server affect SEO?
It does not directly improve your Google rankings. Because it helps AI assistants recommend your products and services with accurate information, it can support your visibility in AI-driven search.
Can I publish my own app inside ChatGPT?
OpenAI lets developers build apps with its MCP-based Apps SDK. To publish, you need to meet OpenAI's review and policy requirements, so check the current terms in OpenAI's developer documentation.
What is the difference between MCP and an API?
An API is a general doorway that lets software systems exchange data. MCP describes that doorway in a standard language AI models understand, explaining to the model what each tool does and which parameters it accepts.
