Managed integration infrastructure
Your API, working inside Claude and ChatGPT in three weeks, and still working after the protocol changes.
Fixed scope, fixed price, a signed tool list before anyone writes code.
$ mcp connect https://mcp.portkeel.com
→ negotiating protocol revision…
✓ connected · revision 2026-07-28 · transport: streamable-http
$ mcp tools list
orders.search (read)
orders.get (read)
inventory.levels (read)
customers.lookup (read)
shipments.status (read)
products.search (read)
reports.daily (read)
orders.flag (write · gated · dry-run required)
8 tools · 1 write · 0 destructive
The objection you arrived with
“Isn’t MCP dead? I’ve been seeing that for months.”
The criticism is real, and it is narrower than the headline. It comes overwhelmingly from solo developers optimising personal coding workflows, where loading a tool schema into context costs more than a direct CLI call, and one widely-shared analysis measured four common servers consuming over 21,000 tokens before any real work happened. That is a true finding about terminals.
It is not a finding about your product. A SaaS exposing its API to customers who already have Claude and ChatGPT open is a different case, and the 2026-07-28 revision is a maintenance argument rather than a eulogy. We draw that line in full, and name both sides, in the field notes.
Shipped 28 July 2026
The largest MCP revision since launch broke most running servers.
The 2026-07-28 revision removed protocol-level sessions and the initialization handshake, reclassified HTTP+SSE as deprecated, and put Roots, Sampling and Logging on a twelve-month deprecation clock. If your server was built against 2025-11-25 or earlier, it now negotiates a superseded revision, and most teams running one do not yet know.
What we build
Three shapes, one spine: a signed manifest, an acceptance script, a retainer.
Product MCP
The official server for your SaaS product
A remote, OAuth-secured MCP server for your public API, so your customers use your product inside their AI client. Up to fifteen curated tools, not an endpoint dump. Three weeks, $4,500 plus $700 per month.
- name: invoices.search
access: read
source: billing-api
scope: org:read
- name: invoice.void
access: write # gated
dry_run: required
destructive: falseInternal Connect
Your database and CRM, inside Claude, without the keys
One internal system exposed as a small read-first tool set for your team. Read replica, least-privilege role, statement timeouts, no DDL. Two weeks, from $2,000 plus $250 per month.
CREATE ROLE mcp_read NOLOGIN;
GRANT CONNECT ON DATABASE app TO mcp_read;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_read;
-- no INSERT / UPDATE / DELETE / DDLAudit & migration
You already built one. We tell you what July broke.
We scan an existing server against the 2026-07-28 revision, fix what the release broke, and take over maintenance. Fixed-fee audit, then hand back or hand over to the retainer.
| Change | Status |
|---|---|
| Protocol sessions & handshake | removed |
| HTTP+SSE transport | deprecated |
| Roots · Sampling · Logging | deprecated · 12-month window |
How it works
Fourteen days, four gates.
- D0–D2 We write the tool manifest with you and you sign it. Nothing is built before signature.
- D3–D9 We build against the manifest and a ten-prompt acceptance script that defines “done”.
- D10–D12 Automated checks, then a human diff review by the founder.
- D13–D14 Deploy, monitoring, handover, and a 30-day defect window opens.
Prices, published
From $2,000 to build, from $250 a month to keep it working.
Internal builds start at $2,000 plus $250 per month. Product servers are $4,500 plus $700 per month. Nobody else in this category publishes a number, which is exactly why we do.
Safety posture
What the server can and cannot do to your data.
- Read-only by default. Writes are opt-in, one tool at a time.
- Every write tool is scoped, dry-runnable, and audited.
- No destructive deletes, ever. Archive or flag, never delete. Contractual.
- OAuth 2.1 with PKCE for remote; client tokens are never passed downstream.
- Contractors hold sandbox credentials only; production secrets never leave our infrastructure.
Read the full security posture, including what we cannot protect against.
Proof you can check without emailing us
Three things a stranger can verify.
A connectable reference build
A live server on real commerce data you can add to your own Claude config and drive yourself.
An open-source scanner
Point it at any public MCP endpoint and get its revision, transport, deprecated features and auth.
Our published method
The tool-manifest format, the acceptance script and the security checklist we gate builds on.
Who we turn away
Five things we refuse, and refer out.
What buyers ask first
- Is MCP dead?
- No, and the question is more specific than it sounds. The context-bloat criticism is real for solo developers running coding agents, where a direct CLI call is cheaper than loading a tool schema. It does not describe a SaaS exposing its product to customers who are already inside Claude and ChatGPT. As of the 2026-07-28 revision, the protocol is being actively maintained.
- What happens when the spec changes again?
- We migrate your server, on the monthly retainer, before the deprecation window closes. The 2026-07-28 revision removed sessions and the initialization handshake and deprecated three primitives under a new twelve-month policy. Every server built before that date is now on a superseded revision, and absorbing that work is what the retainer is for.
- Could our own engineers build this in a weekend?
- Probably, and the SDK is good enough that they should be able to. The real question is whether connector plumbing is what you want two engineers maintaining at 2am when a revision lands. We argue "shouldn’t", never "couldn’t". A fixed build price against two engineers for three weeks of loaded cost is the arithmetic.
- What can the server actually do to our data?
- By default, read only. Every write tool is individually scoped, requires a dry-run, and writes an audit-log entry. There are no destructive deletes, ever, as a contractual absolute rather than a setting. A server cannot fix the model that calls it; it can bound the blast radius, and we say exactly how on the security page.
- Why do you publish prices when nobody else does?
- Because hiding them is a misalignment, and this buyer reads a "contact us for a quote" as a tell. Internal builds start at $2,000 plus $250 per month. Product servers are $4,500 plus $700 per month. The full rate card, the price drivers, and what the retainer excludes are all on the pricing page.
- Where are you based, and can you work our hours?
- Bengaluru, India, on IST (UTC+5:30), with a stated overlap window for US Eastern and UK mornings. Portkeel is deliberately small: a contractor bench works against our scaffold, and the founder reviews every line before it ships. The person who reviews your code is the person who answers your email.
Tell us what you want to expose. We’ll sketch the tool list before any call.
Four fields. A reply within one business day, IST.