Why One Team Scrapped Their Custom AI Pipeline for a Bare MCP Server

Instead, the team shifted to a three-tier design. Claude serves as the reasoning engine that reads user inquiries, drafts SQL, and explains results. A standard web server holds the actual data and context, exposing tools over HTTP using MCP. Finally, a written "skill"—a structured English document loaded into Claude—instructs the model on business logic, metric definitions, and output formatting.

Security, Query Rewriting, and Error Recovery

To protect data without relying on model instruction adherence, all authorization and filtering mechanisms remain strictly on the server. The server accepts read-only SELECT statements, executing one query at a time per request. Rather than relying on string matching, the server parses SQL queries into syntax trees using the PostgreSQL parser. It automatically injects tenant isolation filters directly into every SELECT statement, CTE, and subquery before execution, ensuring users only access data permitted by their standard OAuth credentials.

When queries fail due to warehouse-specific limitations—such as Redshift lacking support for FILTER (WHERE ...) clauses—the server returns structured error messages explaining how to rewrite the syntax. Using these actionable refusals, Claude successfully auto-corrected 87% of failed queries within ten minutes. Furthermore, to prevent hallucinated metric definitions, the server connects to searchable documentation. Claude queried these internal knowledge bases 454 times in 12 weeks to verify business terms before running calculations.

The system also allows Claude to generate shareable reports. Queries, rather than static numbers, are stored so reports reflect fresh data upon refresh. Custom formatted views run within an isolated execution sandbox to ensure security.

Results and Operational Lessons

The operational impact was immediate. Over 12 weeks, the tool handled 1,436 user inquiries, averaging four queries across three minutes per session as users asked follow-up questions and refined their views. The company estimates this saved approximately 1,436 hours of data analyst time—equivalent to roughly four full-time analysts.

However, shifting logic to the client introduced distinct engineering challenges. Managing OAuth authentication led to client registration quirks, while evolving MCP specifications and SDKs required continuous updates. The team also implemented strict integration tests for tool names and arguments, as client models cache tool signatures. Crucially, the authors noted that while "skills" improve model behavior, all security boundaries must remain strictly enforced by server logic to prevent accidental data leaks.

What it means for developers

This implementation highlights a strategic shift in AI application architecture: developers do not need to rebuild reasoning, context handling, or retry loops that base models already handle natively. Instead, engineering effort is better spent building robust integration layers—such as secure MCP servers, AST-level query rewriting, dynamic permissions, and contextual knowledge connectors.

For teams building similar integrations, experimenting with different LLM capabilities is critical to determine which models handle structured tool use and SQL reasoning most reliably. Developers can evaluate and test top AI models cheaply through one API at https://apixoai.online, simplifying the process of comparing model behaviors across complex tasks. Ultimately, treating the LLM as an external reasoning engine while strictly controlling data boundaries on the server provides a safer, more maintainable framework for enterprise AI applications.

Source: We Built an AI Data Analyst, Then Deleted the AI — Towards AI. Written by the Apixo team from that report.