How to connect ChatGPT or Claude to SAP Business One with an MCP server (safely)

By Zain Abbas, Kodenova · Updated 16 October 2026

Short answerPut a small MCP server between the AI assistant and SAP Business One. The server exposes a few named, read-only tools such as sales lookup, stock on hand and customer balance, and calls the Service Layer or read-only SQL views with a restricted SAP B1 user. ChatGPT and Claude both support remote MCP servers as connectors, so users can ask questions in plain language while the server decides exactly what data they may see.

Most SAP Business One users already know where their data is. The problem is getting to it quickly. A sales manager wants last month’s sales by customer. A director wants to know which customers are over their credit limit. Today that means a saved query, a Crystal report or a call to the person who knows SAP.

An MCP server lets the same people ask ChatGPT or Claude, and get an answer built from live SAP B1 data. Done carelessly, it also opens a new door into your ERP. This guide covers how to do it properly.

What the Model Context Protocol is

The Model Context Protocol (MCP) is an open standard for connecting AI applications to outside systems. Anthropic introduced it in November 2024. In December 2025 Anthropic donated it to the Agentic AI Foundation, a fund under the Linux Foundation co-founded with Block and OpenAI. The current specification is dated 28 July 2026.

Support is broad now:

Claude supports remote MCP servers as custom connectors on Free, Pro, Max, Team and Enterprise plans. On Team and Enterprise, an owner adds the connector once and each member signs in to it.
ChatGPT supports MCP apps and connectors. Its developer mode gives full MCP client support, including write tools, on Plus, Pro, Business, Enterprise and Education accounts on the web.
Others, including Gemini, Microsoft Copilot, VS Code and Cursor, also act as MCP clients.

The practical point: you build one MCP server for your SAP B1, and it works with whichever assistant your team uses.

The architecture

The MCP server is a small web service that sits between the AI assistant and SAP Business One. The AI never connects to SAP B1 directly.

 User (ChatGPT / Claude)
        |
        |  MCP over HTTPS + OAuth sign-in
        v
 +---------------------------+
 |  MCP server               |
 |  - tool definitions       |
 |  - user -> SAP permission |
 |  - row/field filters      |
 |  - audit log              |
 +---------------------------+
        |                |
        | Service Layer  | read-only SQL views
        | (restricted    | (SQL Server or HANA,
        |  B1 user)      |  read-only DB login)
        v                v
     SAP Business One company database

Two data paths are common. The Service Layer is SAP’s REST API for Business One. It follows OData and respects SAP B1 authorizations, so it is the cleaner choice for documents and master data. Read-only SQL views are faster for reporting questions, such as sales by month or ageing, where the Service Layer would need many calls. Many projects use both.

Which tools to expose

An MCP server offers the AI a list of named tools. Each tool has a clear purpose and fixed inputs. The AI picks a tool and fills the inputs. It does not write its own SQL.

Tool	Inputs	What it returns
`sales_lookup`	customer, item group, date range	Invoice totals by period, net of credit memos
`stock_on_hand`	item code or name, warehouse	On hand, committed, ordered, available
`customer_balance`	customer code or name	Balance, credit limit, overdue amounts by age bucket
`open_orders`	customer or item	Open sales orders with due dates
`document_lookup`	document type and number	Header and lines of one invoice or order

Start with five to ten tools. A short list with clear descriptions gives better answers than fifty vague ones. If you need help shaping the Service Layer calls behind each tool, our Service Layer query builder is a quick way to test them.

Security rules we apply

This is the part that matters most. An AI assistant with ERP access is a new kind of user, and it should get less trust than a human, not more.

Use a read-only SAP user. Create a dedicated SAP B1 user and database login with read access only. No direct database writes, ever.
Map each person to their own permissions. The user signs in to the MCP server with OAuth. The server knows who they are and applies the same limits they have in SAP: branch, sales employee, warehouse, or no cost prices.
Filter rows and fields in the server. Do not ask the model to hide data. If a sales rep should only see their own customers, the query must only return their customers.
Cap result sizes. Return summaries and the top rows, not full tables. This protects data and keeps answers accurate.
Log every call. Record who asked, which tool, which inputs and how many rows came back. You need this for audits and for debugging wrong answers.
Plan for prompt injection. Text stored in SAP, such as a remark on a business partner, can contain instructions aimed at the AI. Both the MCP specification and the Claude and OpenAI docs warn about this. Read-only tools limit the damage. If you add write tools later, keep them as drafts that a person approves in SAP B1.
Keep tool annotations honest. Mark read tools as read-only. ChatGPT treats tools without that hint as write actions and asks the user to confirm them.

What it costs to run

There are three cost lines. We have not put fixed numbers here because they change; check current pricing with each vendor.

AI subscriptions. Each user needs a ChatGPT or Claude plan that supports connectors. Business and team plans are priced per seat. Check current pricing.
Hosting the MCP server. A small cloud VM or container is usually enough for one company. It needs HTTPS and a secure route to your SAP B1 server, such as a VPN or a private network link.
Building and maintaining it. Most of the effort goes into tool design, permission mapping and testing with real questions. After go-live, expect small changes as users ask things you did not plan for.

You do not pay per API call to OpenAI or Anthropic when users ask questions inside their own ChatGPT or Claude subscription. Usage limits of the plan still apply.

Realistic use cases

A sales manager asks, “Which customers bought less this quarter than the same quarter last year?”
A salesperson on a call checks stock and the customer’s overdue balance before promising a delivery.
Finance asks for customers over their credit limit with invoices older than 60 days.
Purchasing asks which items fall below minimum stock in the main warehouse.
A director asks for a short summary of this week’s sales against last week.

These are questions people already ask. MCP just removes the wait.

Limits you should accept

The model can still be wrong. It may misread a column, mix up gross and net, or guess when the tool returns nothing. Grounded tools with exact field names, units and currency reduce this. They do not remove it.
Vague questions get vague answers. “How are we doing?” needs a defined meaning. Build tools around the reports your company already trusts.
It is not a replacement for reports. Month-end figures, tax returns and anything you sign should still come from SAP B1 reports.
Data quality shows. If item groups or sales employees are messy in SAP, the AI’s answers will be messy too.

How to start

List the 10 to 20 questions your team asks most often.
Group them into five to ten tools with fixed inputs.
Create the read-only SAP B1 user and SQL views.
Build the MCP server with OAuth sign-in, permission mapping and logging.
Test with real users and real questions, and compare answers with SAP reports.
Add it as a connector in Claude or ChatGPT for a small pilot group, then widen.

We build these servers as part of our MCP server development and AI agents for ERP work. You can see one in our SAP B1 AI connector case study.

If you want ChatGPT or Claude to answer from your SAP Business One data, contact us with your SAP B1 version and the questions your team asks most.

Sources

Related services

FAQ

Frequently asked questions

What is the Model Context Protocol?

MCP is an open standard for connecting AI applications to external systems such as databases, files and business software. Anthropic introduced it in November 2024 and donated it to the Agentic AI Foundation under the Linux Foundation in December 2025. Claude, ChatGPT, Gemini, Microsoft Copilot, VS Code and Cursor all support it.

Can ChatGPT or Claude change data in SAP Business One through MCP?

Technically yes, if the MCP server exposes write tools. We recommend starting read-only. If you later add write actions, such as drafting a sales quotation, keep them as drafts that a person approves inside SAP B1.

Does the AI see my whole SAP Business One database?

No. The AI only sees what the MCP server returns from the tools you expose. A well-built server applies the user's permissions, limits rows and fields, and never passes raw database access to the model.

Which SAP Business One versions work?

Any version where you can reach the Service Layer (SAP HANA, and SQL Server on recent 10.0 feature packs) or read-only SQL views. The MCP server sits outside SAP B1, so no add-on is needed on user machines.

Can the AI give wrong answers from ERP data?

Yes. Models can misread figures or fill gaps. Grounded tools that return exact numbers, clear field names and a source reference reduce this, but users should still check important figures in SAP B1.

Ready to get started?

Tell us what you need. You get a clear technical answer, a fixed scope and a price, usually within 24 hours.

Start a project Chat on WhatsApp