Skip to content
Solution 01 · Agent Context

Custom MCP server and knowledge graph development: Your assistants know nothing about your systems. Teach them once.

Your engineers have Copilot, Claude or ChatGPT open all day, and none of them can tell anyone which setting a service reads, which team owns an interface, or what breaks if a value changes. So people paste fragments into the chat and get confident answers built on half the picture. We build a knowledge graph from your own source, publish it through an MCP server every assistant can use, and run every call as the person who asked.

Book a Technical Briefing Watch one question
mcp · graph.impact · 00:02

▸ "What breaks if we change max_retries in order-service?"

✓ identity · token issued for this server

✓ graph.impact · as of release 7.2

✓ callers · 3

✓ configs · 2

✓ tests · 14 read it, 0 assert the limit

✓ citations · file, line, commit on every fact

◆ change request · waiting for a person

→ answered in the assistant you already use

Sound familiar

The question your team asked this morning.

It crosses three systems, so nobody can answer it alone. With your graph, the same question gets one answer, in the assistant your people already use, with every source attached.

Today

team chat

    With your graph

    Software teams

    1. Is the fix for Northwind’s failed payments shipping this week?

      Yes. Northwind’s escalation ESC-881 is linked to PAY-2231, and pull request #4120 closes it 123. It is merged into payments-svc and goes out in Thursday’s release. Northwind’s renewal is open for FY27, so their account team will want to know 4.

      1. ZendeskESC-881escalation from Northwind · opened 4 Nov
      2. JiraPAY-2231retry limit on failed payments
      3. GitHubpayments-svc #4120merged 6 Nov · ships Thursday
      4. SalesforceNorthwind · Renewal FY27open · closes Q1
    1. Dana Northwind escalated again about failed payments. Is the retry fix going out this week?
    2. Sam Not sure which ticket that is. Priya wrote the retry code, maybe ask her?
    3. Priya I moved teams in the spring. Try PAY-2231? No idea if it’s merged.
    4. Dana PAY-2231 doesn’t mention Northwind. Does anyone know who owns the Zendesk side?

    4 messages · 3 people · 5½ hours · still open

    Banks & insurers

    1. Which systems hold customer account numbers, and who can read them?

      Three places: LOANS.CUSTOMER, CRM.EXPORT, and the Account_No__c field in Salesforce, which feeds CRM.EXPORT every night 12. loan-ops-read can query LOANS.CUSTOMER, certified under CTL-118 in October 34. fin-analysts can query CRM.EXPORT, and no control covers that group yet 5.

      1. SnowflakeLOANS.CUSTOMERcolumn account_no
      2. SalesforceClient · Account_No__cexported nightly to CRM.EXPORT
      3. Entra IDloan-ops-read34 members
      4. ServiceNowCTL-118access certification · passed 2 Oct
      5. Entra IDfin-analysts9 members · no certifying control
    1. Morgan Audit wants every system that holds customer account numbers, and who can read them. By Friday.
    2. Alex The loans warehouse for sure. Maybe the CRM export too? The data catalogue is from last year.
    3. Jo Access is in Entra, but the groups don’t say which tables they cover.
    4. Morgan So we are building the spreadsheet again.

    4 messages · 3 people · 5½ hours · spreadsheet started

    Health systems

    1. Which systems hold PHI, and can Fabrikam’s support staff reach them?

      Scheduling holds PHI: it writes APPOINTMENTS and reads ENCOUNTERS 12. Fabrikam’s support staff are in vendor-support, which can reach Scheduling today 34. Nothing gives that group ENCOUNTERS directly.

      1. ServiceNowSchedulingapplication · holds PHI
      2. SnowflakeAPPOINTMENTS, ENCOUNTERStables it writes and reads
      3. Entra IDvendor-support12 members · can reach Scheduling
      4. ServiceNowFabrikamvendor record · support contract
    1. Rae Fabrikam wants remote access for their support team. Which of our systems hold PHI that they could reach?
    2. Chris Scheduling for sure. The CMDB should list the rest, but nobody has updated the PHI flags in a while.
    3. Lee Their group is already in Entra, I think? Not sure what it is scoped to.
    4. Rae I’ll set up a meeting.

    4 messages · 3 people · 5½ hours · meeting booked

    Revenue & data teams

    1. Why does the board pack show Net revenue down 3% when finance says it is flat?

      The definition changed. Net revenue in the board pack comes from net_revenue.sql 12, and pull request #212 started subtracting FIN.CREDITS on 3 October 3. Finance’s figure still uses invoices only, so the 3% gap is the credit notes 4.

      1. Power BIBoard pack Q3 · Net revenuemeasure on page 2
      2. GitHubnet_revenue.sqlsemantic model source
      3. GitHub#212merged 3 Oct · subtracts credits
      4. SnowflakeFIN.CREDITSQ3 credit notes
    1. Maya The board pack says Net revenue is down 3%, but finance says it is flat. Which one is right?
    2. Theo Different definitions, probably. The Power BI measure changed at some point.
    3. Sana I think someone changed the credit-note logic in the SQL? Not sure when.
    4. Maya Can we get on a call before the board meeting?

    4 messages · 3 people · 5½ hours · call booked

    Your graph

    Your systems, answering your questions.

    Pick who you are. The graph assembles from the systems a team like yours runs, and answers in the assistant your people already use, under each person's own sign-in.

    Who you are

    Blue lines join records across systems. No single system holds them today.

    Ask in

      Software teams

      • Jira EPIC Checkout v2 TICKET PAY-2231
      • GitHub PULL REQUEST #4120 SERVICE payments-svc
      • Confluence RUNBOOK Failover guide PAGE API limits
      • Zendesk ESCALATION ESC-881 ORGANIZATION Northwind
      • Salesforce ACCOUNT Northwind OPPORTUNITY Renewal FY27
      • contains
      • merged into
      • from
      • for
      • linked to
      • closes
      • documents
      • documents
      • same customer

      1. Is the fix for Northwind’s failed payments shipping this week?

        Yes. Northwind’s escalation ESC-881 is linked to PAY-2231, and pull request #4120 closes it 123. It is merged into payments-svc and goes out in Thursday’s release. Northwind’s renewal is open for FY27, so their account team will want to know 4.

        1. ZendeskESC-881escalation from Northwind · opened 4 Nov
        2. JiraPAY-2231retry limit on failed payments
        3. GitHubpayments-svc #4120merged 6 Nov · ships Thursday
        4. SalesforceNorthwind · Renewal FY27open · closes Q1

      2. Who owns payments-svc, and is its failover runbook current?

        team-payments owns payments-svc 1. The failover runbook was last edited before pull request #4120 changed the retry limit, so it still describes the old behaviour 23.

        1. GitHubCODEOWNERSpayments-svc → team-payments
        2. ConfluenceFailover guidelast edited 21 Oct
        3. GitHubpayments-svc #4120merged 6 Nov

      3. What is still open in Checkout v2?

        Three of its 14 tickets are open 1. PAY-2231 already has a merged pull request and closes with Thursday’s release 2. The other two have no code yet.

        1. JiraCheckout v214 tickets · 11 closed
        2. GitHubpayments-svc #4120closes PAY-2231

      Banks & insurers

      • SharePoint POLICY Retention 4.2 PROCEDURE Access review
      • ServiceNow CONTROL CTL-118 CHANGE CHG-30412
      • Salesforce OBJECT Client FIELD Account_No__c
      • Snowflake TABLE LOANS.CUSTOMER TABLE CRM.EXPORT
      • Entra ID GROUP loan-ops-read GROUP fin-analysts
      • covers
      • tests
      • certifies
      • can read
      • can read
      • changed
      • exported to
      • on

      1. Which systems hold customer account numbers, and who can read them?

        Three places: LOANS.CUSTOMER, CRM.EXPORT, and the Account_No__c field in Salesforce, which feeds CRM.EXPORT every night 12. loan-ops-read can query LOANS.CUSTOMER, certified under CTL-118 in October 34. fin-analysts can query CRM.EXPORT, and no control covers that group yet 5.

        1. SnowflakeLOANS.CUSTOMERcolumn account_no
        2. SalesforceClient · Account_No__cexported nightly to CRM.EXPORT
        3. Entra IDloan-ops-read34 members
        4. ServiceNowCTL-118access certification · passed 2 Oct
        5. Entra IDfin-analysts9 members · no certifying control

      2. Which controls cover retention policy 4.2, and when were they last tested?

        CTL-118 covers it 12. Its last test was the quarterly access review on 2 October, and it passed 3.

        1. SharePointRetention policy 4.2records and access
        2. ServiceNowCTL-118control · owner: data governance
        3. SharePointAccess review procedurerun quarterly · last 2 Oct

      3. What changed in LOANS.CUSTOMER this quarter, and who approved it?

        One change: CHG-30412 added a column to LOANS.CUSTOMER 12. The change advisory board approved it on 14 October.

        1. ServiceNowCHG-30412standard change · approved 14 Oct
        2. SnowflakeLOANS.CUSTOMERcolumn added: risk_band

      Health systems

      • SharePoint POLICY Remote access SOP Vendor intake
      • ServiceNow APPLICATION Scheduling VENDOR Fabrikam
      • Entra ID GROUP vendor-support GROUP sched-admins
      • Workday TRAINING Privacy 2026 DEPARTMENT Radiology
      • Snowflake TABLE APPOINTMENTS TABLE ENCOUNTERS
      • writes
      • reads
      • can reach
      • administers
      • staff in
      • applies to
      • requires
      • requires
      • assigned to

      1. Which systems hold PHI, and can Fabrikam’s support staff reach them?

        Scheduling holds PHI: it writes APPOINTMENTS and reads ENCOUNTERS 12. Fabrikam’s support staff are in vendor-support, which can reach Scheduling today 34. Nothing gives that group ENCOUNTERS directly.

        1. ServiceNowSchedulingapplication · holds PHI
        2. SnowflakeAPPOINTMENTS, ENCOUNTERStables it writes and reads
        3. Entra IDvendor-support12 members · can reach Scheduling
        4. ServiceNowFabrikamvendor record · support contract

      2. What does Fabrikam have to sign before it gets access?

        The vendor intake SOP applies to Fabrikam, and it requires sign-off under section 3.1 of the remote access policy 12. Intake is open in ServiceNow, and the policy sign-off is not on file yet 3.

        1. SharePointVendor intake SOPnew vendors with system access
        2. SharePointRemote access policysection 3.1 · vendor sign-off
        3. ServiceNowFabrikamintake task open

      3. Which departments still owe the 2026 privacy training?

        Radiology, with 6 people outstanding. It is the only department past the due date 1. The remote access policy requires the training before anyone gets vendor-facing access 2.

        1. WorkdayPrivacy 2026all staff · due 31 Oct
        2. SharePointRemote access policysection 3.4 · training required

      Revenue & data teams

      • HubSpot CAMPAIGN Q3 webinar LIST Attendees
      • Salesforce ACCOUNT Northwind OPPORTUNITY Renewal FY27
      • Power BI REPORT Board pack Q3 MEASURE Net revenue
      • Snowflake TABLE FIN.INVOICES TABLE FIN.CREDITS
      • GitHub MODEL net_revenue.sql PULL REQUEST #212
      • registered
      • includes
      • for
      • billed in
      • credited in
      • shows
      • defined in
      • reads
      • subtracts
      • changed

      1. Why does the board pack show Net revenue down 3% when finance says it is flat?

        The definition changed. Net revenue in the board pack comes from net_revenue.sql 12, and pull request #212 started subtracting FIN.CREDITS on 3 October 3. Finance’s figure still uses invoices only, so the 3% gap is the credit notes 4.

        1. Power BIBoard pack Q3 · Net revenuemeasure on page 2
        2. GitHubnet_revenue.sqlsemantic model source
        3. GitHub#212merged 3 Oct · subtracts credits
        4. SnowflakeFIN.CREDITSQ3 credit notes

      2. Which Q3 webinar attendees are now in open deals?

        Two attendees work at Northwind, and both are contacts on the open Renewal FY27 opportunity 12.

        1. HubSpotQ3 webinar · Attendees2 from Northwind
        2. SalesforceNorthwind · Renewal FY27open · 2 contacts attended

      3. How much has Northwind been billed this year, net of credits?

        $412,000 across 9 invoices, less one $18,000 credit note, so $394,000 net 123.

        1. SalesforceNorthwindaccount · billing ID NW-0042
        2. SnowflakeFIN.INVOICES9 invoices in 2026
        3. SnowflakeFIN.CREDITS1 credit note · August

      Why these projects stall

      A wrapper is not a server, and a shared key is not access control.

      The fast way to give an assistant your systems is to wrap every API endpoint as a tool and hand the server a service account. It demos well. In production the model faces a hundred thin tools to choose between, spends its context reading their descriptions, and calls them under an identity that can see more than the person asking. When the answer is wrong, nothing says where it came from.

      Security reviews stop these projects for good reasons. Whatever a tool returns lands in the model's context, where an instruction hidden in a ticket field looks no different from one the user typed, and it can steer the next call. A token forwarded from one system to the next erases who did what. The NSA's 2026 guidance on the protocol names both risks, and the protocol's own specification forbids passing tokens through.

      None of that is a reason not to do it. It is the specification of what doing it properly means, and it is the part we build first.

      What we build

      Four things, each one a reviewer can check.

      We start with one graph and one server, read-only, and grow from there. That start is the First Graph: four weeks, $35,000 fixed, credited in full to the build if you continue. All four run in your cloud account, from infrastructure as code, behind your identity provider.

      01

      Knowledge graphs built from source

      Parsers read your code, configuration, interface definitions, requirements and tests, and every fact they record points at the file, line and commit it was read from. No model decides what is true: rerun the extraction on the same commit and you get an identical graph. Earlier versions are kept, so a question can be answered for the release it is about.

      02

      MCP servers over the systems you already run

      A handful of tools shaped around the questions people actually ask, not one per endpoint. Typed inputs, a tool contract pinned in CI so it cannot drift unnoticed, long jobs run as tasks the assistant can check on, and one audit line for every call. The same server works in every assistant your people use.

      03

      Several servers, one person, no deputy

      When an answer needs two systems, the assistant asks each one with the person's own sign-in. Servers never call each other and never hold anyone else's credentials. What one server's answer brings to another is checked against that server's own index before it is used, and a conflict is reported rather than quietly resolved.

      04

      Review and migration of what you already have

      A security review of an existing MCP deployment against the 2026-07-28 specification and its security best practices, and a plan to move it: off the deprecated transport, from sessions to explicit handles, and from dynamic client registration to client metadata documents.

      What an MCP server is

      1

      Server, usable from every MCP-compatible assistant

      3

      Coordinates on every fact: file, line, commit

      0

      Shared service keys: every call runs as a person

      0

      Writes without a person's approval

      Walkthrough

      Watch one question become a cited answer.

      “What breaks if we change max_retries in order-service?” Six steps from that question, typed into the assistant an engineer already uses, to an answer that cites its evidence and a change that waits for a person.

      1. 01 / 06

        Your source becomes a graph, by code.

        Parsers read the repositories, configurations, interface definitions and specifications that go into your build. Every fact they record points at the file, line and commit it was read from. No model decides what is true: run it again on the same commit and you get the same graph.

        Extraction · release 7.2
        • orders/retry.pyreads max_retries · 3 callers
        • config/prod.yamlsets max_retries = 5
        • tests/14 tests read it
        model calls · 0a91c3e7
      2. 02 / 06

        An engineer asks, in the assistant they already use.

        Copilot, Claude or ChatGPT turns the question into a typed tool call to your MCP server. The server checks the token on this very request: issued by your identity provider, for this server, for this person. It is never passed on to anything else.

        Tool call
        tool     graph.impact
args     { "setting": "max_retries",
           "service": "order-service" }
caller   the engineer who asked
token    audience = this server ✓
      3. 03 / 06

        The server asks the graph, not the model.

        The lookup is a graph query the server runs itself: who reads this setting, which configurations set it, which tests touch it, as of the release the question is about. Questions that cross several hops are exactly where a graph beats search.

        Graph · as of 7.2
        • callersretry.py · worker.py · api.py
        • configsprod.yaml · staging.yaml
        • tests14 read it · 0 assert the limit
      4. 04 / 06

        The answer comes back with its evidence.

        The assistant receives facts, each with the file, line and commit it came from, and writes its answer from those alone. Anyone can check a claim in seconds, and an answer that cites something the graph never returned is rejected rather than shown.

        Answer · cited
        • retry.py:42reads max_retries
        • prod.yaml:18sets it to 5
        • tests/no test asserts the limit
        every fact citeda91c3e7
      5. 05 / 06

        A change waits at the gate.

        The engineer asks for a test that covers the limit. The server drafts the change request and stops. A reviewer sees exactly what will be filed, and the approval is pinned to that version: edit one field and it has to be approved again.

        Change request · draft
        title    Add a test asserting max_retries
system   your change tracker
status   awaiting approval · v1
      6. 06 / 06

        Approved, filed, and on the record.

        Once a person approves, the change is filed, and every call along the way has left one audit line: who asked, which tool ran, who approved. The audit log names people, never a machine account.

        Audit log
        • 09:14graph.impact · engineer
        • 09:15change.draft · engineer
        • 09:21change.file · approved by reviewer
        shared service keys · 0unreviewed writes · 0
      A technical drawing of the system inside your environment: source repositories pass through parsers into a knowledge graph. An engineer at a desk asks an assistant, whose model sits outside your environment; the question reaches an MCP server, which checks the person's token with your identity provider and queries the graph. A change request stops at a write gate beside a reviewer, then is filed in a system of record, and every step is written to an audit log.

      Anatomy of a call

      Reads run on their own. Writes stop at the gate.

      Every call passes the same checkpoints in the same order, whichever assistant sent it. The model chooses which tool to call; it never decides who is calling, what they may see, or whether a record changes.

      1. any MCP client
      2. 1 · ASSISTANT Copilot, Claude, ChatGPT The model picks a tool and its arguments. That is all it decides.
      3. 2 · IDENTITY Token checked on every request Issued by your IdP, for this server, for this person. Never passed on.
      4. 3 · TOOL CONTRACT A few typed tools, pinned in CI What may be called is fixed by policy before the session starts.
      read
      KNOWLEDGE GRAPH Facts with file, line and commit, returned straight away
      write
      WRITE GATE A person approves this exact version of the change Edit one field and the approval no longer applies.
      1. every call
        4 · AUDIT LOG One line: the person, the tool, the approver A source that is down is recorded too, and the answer says what it could not consult.
      The model appears once, at the top. Identity, the tool contract, the gate and the audit log are code you can read.

      Governed by default

      A new door into your systems gets the same lock as the others.

      The specification standardises the conversation between an assistant and a server and deliberately says little about policy. These are the controls we put into every server we build.

      Your identity provider decides who gets in

      Each server is an OAuth resource server that publishes its protected-resource metadata, checks that every token was issued for it, and accepts enterprise-managed authorization, so your IdP decides who reaches which server by group and role.

      Least privilege, raised one step at a time

      A session starts with read-only scopes. A privileged tool challenges for the scope it needs the first time it is used, and the elevation is logged with the request that caused it.

      Nothing changes without a person

      A tool that changes a record first shows the person the change it intends to make. Approval is pinned to that version of the change: alter one field and the approval no longer applies, and a replayed approval is refused.

      How the write gate works

      Every answer cites its evidence

      Each fact resolves to the file, line and commit, or the record and version, it was drawn from, and a reviewer checks it in seconds instead of re-deriving it.

      Read the provenance teardown

      Caller text is data, never instructions

      What the model is allowed to call is fixed by policy before the session starts, so nothing it reads in a document or a tool result can add to that list. Tool descriptions are checked for invisible characters before release, because an instruction a reviewer cannot see is still one the model will follow.

      How tool abuse is contained

      One failure stays one failure

      Heavy work is isolated per request and rate-limited per person, so one runaway job cannot starve everyone else. When a source is unavailable, the answer is still returned, marked with the source it could not consult, rather than padded with a guess.

      Where a graph earns its keep

      A graph answers relationships. It is not better at everything.

      Graph retrieval wins on questions that cross several hops: who depends on this, what breaks if it changes, which requirement no test reaches. For a single-fact lookup, plain search is as good and cheaper; a controlled 2025 comparison found the two complementary rather than one ahead of the other. We use each where it wins, and every answer says which one produced each fact.

      Engineering graph

      Components, interfaces, settings and faults, and how a change travels through them.

      Traceability graph

      Requirements, code, tests and changes, linked on the artifacts themselves so the link cannot quietly go stale.

      Business graph

      Entities, metrics and lineage, built on the semantic layer you already maintain.

      AI-ready data

      Configuration graph

      Which product variant carries which options and which software, release by release.

      Before you hire anyone

      When we will tell you not to build one.

      One person, one machine

      Someone automating their own work locally is better served by a command-line tool or a packaged skill. Both are lighter, and both cost the model less context.

      Your platform already ships one

      Databricks and Snowflake publish managed MCP servers for the data they hold. Use them, and spend the budget on the systems nobody has connected yet.

      A thin wrapper is all you need

      If every tool would map to one endpoint and every question is a single lookup, you do not need a graph or us. We would rather say so in the first call than in the third month.

      Asked in the first meeting.

      Already have an MCP deployment stalled in review? The Security Review Memo answers it in five business days, without access to your data.

      Any client that speaks the Model Context Protocol. VS Code with Copilot, Claude, ChatGPT business plans, Gemini Enterprise and the command-line coding agents all connect to remote MCP servers. Support for individual features still varies by client, so we test against the assistants your people actually use.

      The graph holds facts with pointers back to their source, and it lives in your account. The source of truth stays where it is. A fact is the name of a thing, how it relates to other things, and the file, line and commit it was read from, so it can always be checked against the original.

      You do. The graph and the servers deploy into your own cloud account from infrastructure as code, behind your identity provider, and you receive the full source with its history and tests. There is no licence and no per-seat fee.

      The one your platform team is willing to run. The model of the graph matters more than the engine, and it moves between engines. We resell nothing, so the recommendation follows what you already operate and support.

      Yes, on a twelve-month clock rather than overnight. The protocol became stateless, the older server-sent-events transport is deprecated with a year-long window, and client metadata documents replace dynamic client registration. Existing servers keep working during the window, so the migration is planned work, not an emergency.

      Not on its own authority. A change passes through the write gate, where a person reviews the exact edit and approves that version of it. We start read-only and introduce write tools one at a time, after the read tools have shown they can be trusted.

      Bring the system nobody can explain.

      The one whose behaviour lives in three repositories, two spreadsheets and one person's memory. That is where a knowledge graph pays for itself first, and a four-week First Graph is the fastest way to find out whether this is worth doing.

      Book a Technical Briefing See all solutions