All your tools in ChatGPT and Claude. The internal ones too.
SAP, Navision and your databases behind the firewall. Google Ads, Search Console, Stripe and AWS in front of it. One connector for everybody, with SSO, per role permissions and a single audit log.
„Which of my accounts has an invoice open longer than 30 days?“
Used open_invoices from ACME ERP
Three accounts have invoices open for more than 30 days:
| Account | IBAN | Open | Overdue |
|---|---|---|---|
| Nordwind Handel GmbH | DE•• •••• 4471 | € 12.400 | 41 days |
| Alpen Logistik AG | AT•• •••• 0912 | € 8.150 | 36 days |
| Müller & Söhne KG | DE•• •••• 3308 | € 3.900 | 33 days |
Four checks between the model and your data.
Every tool call takes the same path, whichever client it came from. Who asked, what they were allowed to see, what left your network, and one log of all of it.
One URL your users install. OAuth on the outside, your own identity provider on the inside, your server untouched.
- 01
Identify
OIDC/SSO against your own IdP, including Microsoft Entra. The call runs as the person who made it, never as a shared service account.
- 02
Authorize
Per-role, per-tool, read or write. Anything not explicitly granted never shows up in the tool list in the first place.
- 03
Mask
Field-level masking and pseudonymization applied on your side, before the result travels. The model never sees the raw field. Composio, AnythingMCP and both provider tunnels have no field-level masking at all.
- 04
Log
Who asked, which tool, which records, which fields were masked. One audit trail across every AI client, exportable for review.
One policy, every client. The rules live in the gateway, not in the AI tool. Add a client, and it inherits the same access rules, masking and audit trail. Nothing to re-implement per vendor.
The answers stop being generic.
Same people, same assistant. The difference is that it can now see your systems, and only the part each person is allowed to see.
“Which of my accounts has an invoice open longer than 30 days?”
Answered from your ERP, limited to the accounts that person owns.
“Summarize every ticket this customer opened since March.”
Answered from your service desk, with the fields you marked as personal held back.
“Can we ship the Meyer order this week?”
Answered from your stock and delivery tables, read only.
Three ways in.
Connect what you already use
Live in minutesGoogle Search Console, Google Ads, Stripe, Airtable, PostHog, GitHub, Supabase, Grafana, an n8n workflow, a Make scenario, or an MCP server built by your own team. Sign in once and it inherits OAuth that Claude and ChatGPT actually accept, one access per person instead of one shared token, and a full audit trail. The server stays where it is, even inside your network.
Free, up to 2 MCP servers
Have us generate it
Same dayYou have an OpenAPI spec, a reachable REST API or a SQL database. We turn it into an MCP server: point us at it, name the tools, mark the personal fields. Live the same day.
From €99 per month
Have us build it
Five working daysNo spec, an unusual protocol, or nobody with the time. We build the MCP server, name the tools, mask the personal fields and hand it over live. Nothing to pay if we miss the date. Optional on every tier.
€990 once
Systems that are not reachable from outside run behind your own Runner, inside your network. +€199 per month, on any tier.
Internal ERP, nothing exposed: that is a tier, a runner and one connector built for you. What it costs is on the pricing page, where the ladder is kept.
A connector built for you is included from €99 per month, on the Team tier.
First connector live in five working days. If the first tool call isn't live on day five, the setup fee is on us.
You could build this. Then you'd run it.
One database, one team, a developer who enjoys this: a weekend gets you an MCP server in a container, a tunnel and a token in a config file. That works, and we won't pretend otherwise.
It stops working when the second system arrives, and again when the second assistant does.
Build it yourself
Two systems × three role profiles = six servers
6 containers · 6 tokens · 6 logs · 24 approvals
every server is added and approved in every assistant, one by one
With Loopthink
One connector, four assistants
one identity · one policy · one log
Two systems. Three role profiles, because in an AI client a connector is either on or off and there is no layer underneath it. Four assistants. Two times three is six servers to deploy, patch and log, and six times four is twenty-four registrations to approve, because every server is added to every assistant separately. Five systems on those same three role profiles is fifteen servers and sixty registrations, and one list to work through every time somebody leaves.
| Build it yourself | With Loopthink | |
|---|---|---|
| What you deploy | One server per system, per role profile, per assistant | One connector, on your own domain |
| Who the target system sees | One service account, the same for everyone | The person who asked |
| Who can use which tool | Anyone who has the connector | Only the tools their role grants, at server level and at tool level |
| Someone leaves | Revoke in every system and every client | One switch in your identity provider |
| Who keeps it running | Your team, from now on | Us |
Who does the work
Nobody at your company writes code for this. You point us at a system, name the tools in your own words and mark the personal fields. That is configuration, not development.
It carries your name, not ours. Your people don't install “Loopthink”. They install your company's connector, on your own domain, with your logo, sitting in the same list as every other connector in Claude and ChatGPT. Rolled out once, for everyone.
Build it yourself if you have a platform team that wants to own an internal MCP gateway. Done properly, that means per-user OAuth, role resolution against your identity provider, policy per tool, masking on the way back and one audit trail across every assistant. At that point you are not building a connector, you are building a product. You can also have it on Friday.
How this compares.
| Loopthink | Microsoft SQL MCP Server | AnythingMCP | Composio | Anthropic MCP Tunnels | |
|---|---|---|---|---|---|
| Reaches systems not exposed to the internet | Yes | No | Not documented | Enterprise only | Yes, but not in claude.ai |
| Field-level masking before the model sees data | Yes | No | No | No | No |
| Runs as the person who asked | Yes | Partly | Not documented | Partly | No |
| One audit trail across Claude and ChatGPT | Yes | Per server | Per gateway | — | Tunnel events only |
| Your own connector domain and logo | Yes | — | No | No | — |
| Somebody builds it for you | Yes, €990 | No | No | No | No |
| Entry price | Free, then from €39 | Free | €19 | Free | Free, research preview |
Connecting a single database, and you have a developer team? Microsoft's SQL MCP Server is free, production-ready and runs on-premises. It is the right choice, and we don't compete with it. We govern it, alongside everything else you connect.
Looking at a specific gateway? Row by row, with sources: Composio alternative · MintMCP alternative · MCP Manager alternative · AnythingMCP alternative
Governing MCP Access to Enterprise Systems
Gateway architecture, field-level masking, and deployment topologies, written for architects, security engineers and CISOs. Deliberately explicit about what a gateway does not solve.
- Compliance mapped to controls. GDPR, EU AI Act, DORA and BSI C5 requirements against concrete technical and organizational controls.
- Vendor-neutral. The same policies across models and cloud providers, without locking governance into a single hyperscaler.
Credentials stay in the Runner, inside your network. Hosted in the EU, or deployed entirely on your own infrastructure for air-gapped and highest-regulation environments.
40%+ of agentic AI projects will be cancelled by 2027, on weak governance and unclear ROI. Gartner.
The questions that come up before the pilot.
- Who in our company has to add the connector?
- On Claude Team and Enterprise plans, only an Owner can add a custom connector. We hand you a prefilled link you can forward, plus a one-page note for your security team. On Free, Pro and Max you can add it yourself.
- Can't we just build our own MCP server?
- For one reachable database, yes, and the open source servers are good. What doesn't come with them is per-user identity into the target system, permissions at tool level, field masking, one audit trail across assistants, and somebody who patches it. That is the part we sell, and an existing MCP server keeps working: point it at us and it inherits all of it.
- Do we need developers?
- No. You connect a documented API yourself, or we build the connector for €990 in five working days. Naming the tools, setting the role matrix and marking personal fields is configuration, not development. What you do need is somebody who can decide which role sees what.
- Where do our system credentials live?
- In the Runner, inside your network. The gateway never needs to see them.
- How many tools will our people get?
- A curated set, typically under fifteen tools per connected system, named in your own business language, read-only by default. What one person sees is smaller again, because they only ever get the tools their role grants, not the catalogue. Read and write are always separate tools, and we deliberately do not expose every table.
- What happens after the five days?
- The connector is yours and running. You are on your monthly plan, and you can add systems yourself or book our team by the day.
- Do we need a Claude or ChatGPT contract?
- Yes, on their side. We govern the access, we don't resell the assistant.
- What does Loopthink not solve?
- Bad data stays bad data, and a governed connector is not a data warehouse. The whitepaper is deliberately explicit about the limits.
See your systems answer in Claude.
Tell us which systems you run and who should be able to ask. We connect a system like yours, mask the sensitive fields and follow a request through the gateway.
- Thirty minutes, no slides: a system like yours, live in Claude and ChatGPT
- For CTOs, IT and application leads, and the people who own the systems
- Your details stay in the EU
MCP authentication, in depth.
- September 21, 2026Connect DynamoDB to Claude: where the IAM policy stopsDynamoDB does have fine-grained access control, down to the item and the attribute. Four places it stops once the caller is a chat client shared by a team, and what the trail says instead of a name.→
- September 21, 2026CloudWatch Logs in a chat client: who may read the log line?AWS has real masking for log data. It runs at ingestion, for the whole log group, reversed by a single IAM permission. Why that shape does not survive contact with a team, and what to put in front of it.→
- September 13, 2026Can you use the Microsoft SQL MCP Server with SSO in Claude?Short answer: not directly. What it takes with Azure API Management and Entra ID, the token exchange that is currently broken, and the three things you still won’t have once it works.→
- September 13, 2026Your ERP is already connected to ChatGPT. Nobody told you.The connector is called CSV export, and it runs in every department. Why that is the rational thing to do, what actually leaves the building, and what the permitted path has to look like to win.→
- August 26, 2026Do you need an MCP OAuth proxy? Five options comparedA remote connector wants an authorization server, most MCP servers have none. Five ways to put one in front, compared honestly, including the free ones.→
Your teams already use AI.
Give them one connector.
Yours, branded and governed, with your internal systems behind it and nothing exposed to the internet.