A professional company MCP server needs six things before you share it: authentication that matches the current spec, a data boundary you can explain in one sentence, answers that cite their sources, content as fresh as the business, tools you can account for, and a name that says who it speaks for. Everything below is that list, expanded into checks you can actually run.

1. Auth that matches the current spec

MCP auth has moved fast, and clients follow the spec, not your release schedule. Current means OAuth 2.1: users sign in as themselves, tokens carry an issuer the server validates, and client registration follows the CIMD flow so new MCP clients can connect without a manual setup ticket. SuperCognit servers implement this out of the box; if you built yours by hand against an older draft, fix this first, because it is the thing that fails at connection time — in front of the person you shared it with.

  • Every user authenticates individually — no shared key in a config file that outlives the person who pasted it.
  • Issuer validation is on. A token from the wrong place is a no.
  • Connecting works from Claude and from at least one other MCP client. Test both before anyone else does.

2. A boundary you can explain in one sentence

The sentence is: this server answers from this workspace, and nothing else. Per-workspace isolation makes that structural rather than aspirational — the server cannot reach knowledge that is not in its workspace. Your job is the deliberate part: deciding what goes in, and whether the server is private or public. A private server is an internal company brain — SOPs, policies, product facts for your own team. A public one speaks for the company to anyone who connects. Those are different products, and the choice should have a name attached to it, not a default.

3. Answers that show their sources

A company MCP gets quoted — in documents, in decisions, eventually in a meeting where someone asks where that came from. Cited answers make that moment boring instead of career-limiting. When the knowledge base is built by crawling your site, every answer points back to the page it came from; uploaded documents are cited the same way.

  • Ask the ten questions your team actually asks, and follow every citation back to its source.
  • The same build produces a chat agent — use it as the smoke test. If the chat answers are wrong, the MCP answers are wrong with extra steps.
  • Nothing in the knowledge base would embarrass you quoted verbatim. It will be quoted verbatim.

4. Content as fresh as the business

Stale answers are worse than no answers, because they arrive with confidence. Knowledge re-syncs on a schedule — as often as every 15 minutes — and the cadence is a decision per source, not a global toggle to set and forget. Pricing, availability and policy pages earn a fast schedule; the company history page can wait. For uploaded documents the sync cannot save you: every document needs an owner who replaces it when reality changes, or the server becomes a very confident archive.

5. Tools you can account for

Knowledge answers questions; tools take actions. HTTP tools you attach become callable MCP tools, which means anyone connected can invoke them — so the standard is stricter than it is for content. Before sharing, you should be able to say, for every tool on the server: what it can touch, what the worst plausible call does, and why it is attached at all. A short tool list is a feature, not a gap. A server is judged by what it can do, not only by what it knows.

6. A name that says who it speaks for

Custom domains are supported, and for a company server they are not cosmetic. A team connecting to your own hostname knows whose product this is and who stands behind its answers; a platform URL says the opposite. If the server is going to speak for the company, it should live at the company's name.

Notice the pattern in the list: none of it is code, all of it is decisions — what goes in, who connects, how fresh, what it can do, whose name is on it. The build itself is the fast part; a crawled, cited knowledge base exists about two minutes after you import the site. Spend the time you saved on the checklist.