Knowledge

Analyses & teardowns

How agent-ready is German B2B software? Every analysis is grounded in real assessments, with numbers from the German MCP Report.

What free agent scanners do not check, and why a 40/100 from one is not a passing gradeFree scanners check whether files exist. We send real agents against your API. The difference between a surface score and operational readiness: in detail.
awork MCP: What the best German agent access looks like, and what others can learn from itawork runs the currently best German MCP endpoint (53/100 in our report): OAuth 2.1 with PKCE, an open OpenAPI spec, a real server card. An analysis of why it works.
Clockodo MCP Server: How we found the third official endpointClockodo runs its own MCP endpoint at mcp.clockodo.com: reachable, OAuth-protected, tools behind auth. Documented nowhere. How we found it and what it shows.
Collmex MCP: When the API itself is the anti-patternCollmex speaks neither REST nor JSON, but a CSV record protocol behind a CGI URL: with a LOGIN record instead of an authentication standard. Why this is the hardest result in our report for AI agents.
Connecting AI Agents: What 21 German B2B SaaS APIs Reveal About ItConnecting AI agents means giving the software tools, not giving the agent instructions. What the German MCP Report 2026 measures across 21 German APIs, and which three paths to a connection exist.
easybill MCP: What remains of the "official integration" and what actually existsIs there an official easybill MCP connector? We checked: all evidence leads to third parties. What the easybill API can do today and what is missing for agents.
JTL MCP: Why JTL's "Build with AI" is the right direction and still not agent accessJTL explicitly opens its developer documentation to AI tools: specs indexed for MCP, llms.txt, a Build-with-AI page. An official MCP endpoint is still missing. An assessment.
Lexware MCP server: What the largest of seven community servers reveals that the vendor is missingLexware Office has no official MCP server, but it has seven community projects, the largest with its own OAuth wrapper. A code-level view of what customers are already building themselves.
The MCP Agency: What to Look for When Choosing OneFinding an MCP agency is easy; finding a good one is rare. Eight criteria that let you recognize a partner for your MCP endpoint within 30 minutes, plus the red flags.
API key or OAuth? Why agents should not run on the master keyAI agents act on behalf of your users, and static API keys are the wrong key for that. What OAuth 2.1, scopes, and automatic client registration concretely achieve, and why 9 of 21 German APIs need rework here.
What an MCP Audit Must Check: The ChecklistWhat an MCP audit must check: endpoint and spec version, OAuth delegation, write safety, tool descriptions, the GDPR chain, and live agent tests. The complete checklist.
Who is building the MCP servers for the German Mittelstand? An ecosystem reportFor most German B2B SaaS products there is no official MCP server, but instead a growing community wave: over 25 unofficial projects for the tested products alone. A data report on the gap nobody fills.
Making Software MCP-Ready: The Three Approaches ComparedMaking software MCP-ready means: one endpoint, real delegation, machine-readable documentation, a security posture. The three approaches (proxy, gateway, own endpoint) compared, with a decision guide.
MCP security vulnerabilities: how AI agents become an attack vector (and what your API must do about it)The 6 most common security vulnerabilities in MCP integrations: from open servers without login to deleting agents without confirmation. With examples from our report on 21 German SaaS APIs.
MCP servers and GDPR: what you need to set up before your customers let AI agents onto your APIData flows, data processing, deletion periods, EU hosting: the GDPR obligations around MCP servers, sorted out technically, without legal advice.
Running an MCP Server: Hosting, Maintenance, and What Operations Really CostAn MCP endpoint is not a project with an end date but an operation: hosting options, what changes constantly (spec, models, auth), and what maintenance costs per month.
What does an MCP server cost? The honest calculationWhat does a production-ready MCP server cost? A transparent breakdown by cost item: authentication, write safety, testing, operation, and why the cheap variant ends up expensive.
MCP Specification July 2026: What has changed and why your integration needs maintenanceThe MCP specification 2026-07-28 has fundamentally rebuilt the protocol: stateless, new discovery, new auth details. What that means for existing integrations.
Tool descriptions are code: the underrated interface of your MCP serverAn AI agent decides what it does based on your tool descriptions. And an unclear description produces no error message, but wrong bookings. Why descriptions are code and how to regression-test them.
MCP vs Agent Skills: Two Layers That SaaS Vendors ConfuseAgent Skills teach AI agents HOW to approach a task. MCP gives them access to your software. Why SaaS vendors cannot get past the first layer.
MCP and REST: Why you need both, and why a REST API alone is no longer enoughMCP does not replace your REST API. It builds on top of it. The honest comparison: what REST delivers for machines, what agents additionally need, and why 14 of 21 German APIs fail at exactly this point.
Personio and llms.txt: Why "AI-friendly documentation" is still far from agent accessPersonio ships llms.txt and OAuth2, and as of 2026-09-22 it also runs its own MCP endpoint (mcp.personio.de, undocumented). An assessment of what documentation signals say about an API's real agent capability. An assessment of what documentation signals say about an API's real agent capability (and what they do not).
propstack MCP: Five community projects, zero official answer, one proof of demandAt propstack there are at least five private MCP projects, but no official endpoint. Why such a pattern is the best demand signal there is.
Remote MCP Server: What Your Endpoint Needs So That Claude and ChatGPT Can Connect to It via URLWhat a hosted MCP server must support per specification 2026-07-28 so that Claude and ChatGPT can connect via URL: transport, OAuth 2.1, metadata.
Self-hosting or third-party gateway? The difference your customers feelThird-party gateways turn MCP integration into a one-click experience and shift data, rights, and responsibility to third parties. An honest comparison of both routes.
seven.io MCP: The SMS provider that takes agent access more seriously than some CRM heavyweightsWith "Seven MCP", seven.io delivers a hosted, OAuth-secured MCP endpoint plus an npm package. What the second official vendor in the German MCP Report gets right.
What is MCP? And why your SaaS customers will soon expect it to just workMCP (Model Context Protocol) explained without jargon: what AI agents need to work with your software, and why 18 of 21 audited German SaaS providers do not offer it yet.
Xentral MCP: Public API specs, but agent delegation is missingXentral maintains its API specs publicly on GitHub and delivers LLM-friendly docs. An official MCP endpoint and an OAuth delegation model are still missing. An analysis.
Zammad-MCP: Customers want it, the community builds it, officially it is "not really planned"Zammad has no official MCP integration, but it has an active community, a 41-star community server, and a role for agents in ticket support. What works today and what is missing.