Hosted MCP server or self-hosted: decide on whose identity the call runs under, not on who runs the box
A hosted MCP server such as Makini or CData Connect AI is the fastest route to SaaS maintenance and ERP systems when it carries each user's identity. For OT-adjacent, KRITIS-regulated or validated systems, self-host a vendor server where one exists, otherwise a custom server with named operations. Identity and write rights decide more than location.
The answer first
Four ways to put an MCP server in front of an industrial system, on five criteria
| Criterion | Hosted gateway (Makini) | Managed platform (CData Connect AI) | Vendor's own server (D365, Vault, WinCC OA, HighByte) | Self-hosted custom server |
|---|---|---|---|---|
| Whose identity | Each connection runs on its own scoped credentials, signed in with credentials you already use; how individual users map to connections is not stated publicly | User-level authentication with OAuth 2.1, PKCE and SSO; source-system permissions are honoured | Varies: Business Central acts as the user via Entra; Vault takes API access tokens under Vault permissions | Designed per system: per user where the source can authorise, a documented narrower tool list where it cannot |
| Where it runs | Cloud, with EU and UK in-region hosting, dedicated single-tenant, or self-hosted | Cloud; no self-hosted option on its product page on 19 September 2026 | Vendor cloud for D365 and Vault; your plant network for WinCC OA and HighByte | Your network or cloud tenant |
| Tool design | Generic search, get, create and update across each product's objects | Query and act across 100+ sources through one interface | The vendor's choice: D365 exposes data, form and action tools; Vault exposes allow-listed agent actions | Named operations per use case, such as get_open_work_orders_for_asset |
| Writes | Create and update included; scope follows the connected credential | Read and act, per its product page; CData's open-source Epicor server is read-only | WinCC OA's server warns it can modify configuration and runtime data; Business Central is read-only by default | None until a named write is reviewed with the system owner |
| Who maintains it | Makini, across 2,000+ products it lists | CData, across its connector catalogue | The vendor, through its releases; D365's static 13-tool server retires on 1 October 2026 | You, or whoever you pay to run it |
Built from each provider's public pages and documentation, read on 19 September 2026. Not a test of any product; the open points are the questions in the cards below.
Why location stopped being the deciding question
The instinct in a regulated plant is to sort MCP servers into hosted and self-hosted and to reject the hosted column. That instinct is out of date. Makini, the one gateway we found with MCP coverage across most of the maintenance and MRO systems we checked, offers in-region EU hosting, a single-tenant instance and self-hosting, and holds SOC 2 Type II. Location is now a checkbox in the order form.
What does not change with the order form is the tool shape and the identity. A gateway that exposes generic create and update tools across every object puts the question of what the agent may do into the credential behind the connection. If that credential belongs to a planner, the agent can do what a planner can do, everywhere the gateway reaches. A server with named operations puts the same question into a list a person can read.
Identity is the second axis. AWS's own guidance on hosting MCP servers names consistent authentication to the server and to the downstream resources as the main consideration once servers are remote. CData answers it with per-user OAuth and source permissions. Vendor servers answer it inside their own product. For OT-adjacent systems that authenticate one technical user, nobody's gateway can invent a per-user model the source does not have, and that is where a self-hosted server with a narrowed tool list earns its cost.
So the verdict splits by system, not by vendor.
One real strength each
What each option does better than the others, and the question to ask it
Hosted gateway: Makini
Breadth: one endpoint across the ERP, maintenance and warehouse systems it lists, including HxGN EAM, IFS Ultimo, AMOS, Fiix, Maximo, Epicor and QAD, with EU hosting and a self-hosted option.
When ten planners use the agent, does each of them get their own scoped credential, or do they share one connection's rights?
Managed platform: CData Connect AI
The clearest identity story of the hosted options: per-user authentication with OAuth 2.1, PKCE and SSO, and source-system permissions honoured on every query.
Can it run inside our network, and which of our industrial systems are in its catalogue rather than only our business applications?
The vendor's own server
Maintained by the people who change the product. Dynamics 365, Veeva Vault, Siemens WinCC OA and HighByte all ship one, so the server moves with each release instead of breaking on it.
Which of its tools are enabled by default, and can we switch off every tool that writes before the first agent connects?
Self-hosted custom server
The only option where each tool is a named operation agreed with the system owner, running next to the system in your own network, with the log in your hands.
Who maintains it when the source system is upgraded, and is that cost in the plan from the first day?
Same task, two tool shapes
What the agent sends when a planner asks for open work on one pump
Illustrative only: neither block is any vendor's actual schema. The first is the shape of a generic object tool, the second a named operation. Both return the same work orders; they differ in what else the same tool could do.
# 1) Generic object tool (gateway shape, illustrative)
call: update # sits in the same tool list as search and create
args: { object: work_order, filter: { asset: P-104, status: open } }
# What limits this call: the credential behind the connection. Nothing else.
# 2) Named operation (custom shape, illustrative)
call: get_open_work_orders_for_asset
args: { asset_id: P-104, site: NORTH }
# What limits this call: it can only read open work orders for one asset.
# Writing is a different tool, reviewed separately, and may not exist.The first block is a mistake a model can make: it asked for an update where it meant a search. The second tool list cannot express that mistake.
Which one, per system
The condition that picks each option
Ask this per system, not per estate
Can the source authorise each person separately, and would an unintended write be an inconvenience or an incident?
- SaaS maintenance or ERP system, per-user identity available, writes are routine
- A hosted gateway or managed platform is the fastest start. Makini for breadth across maintenance and MRO systems, CData Connect AI where per-user OAuth matters most. Restrict write tools until a workflow needs them.
- The vendor ships a server for the exact product and version you run
- Use it, deployed with write and configuration tools disabled, and put it behind the same identity and logging as your other servers. Especially WinCC OA, whose own repository warns it can change configuration.
- OT-adjacent, KRITIS-regulated or GxP-validated system
- Self-host, inside the network zone the system already lives in, with named read operations only. Use the vendor's server if one exists; build one if not. An unintended write here is an incident, so the tool list must make it impossible.
- Only one technical user can authenticate to the source
- No hosting choice fixes that. Narrow the tools to what every permitted user may see and log the requesting person outside the source system.
Where we would tell you to buy the gateway
A mid-sized manufacturer with Fiix, a cloud ERP and no OT access in scope, who needs five systems connected this quarter, gets more from Makini or CData in a month than from us in the same time. Our build is slower per system, and the named-operation discipline pays back only where a wrong write costs more than the wait. Where it does, the build is described on Claude MCP server development.
Related reading
- Claude MCP server development for internal systems — how we build the self-hosted custom option: named tools, user identity, audit log
- MCP servers for industrial systems: 52 systems mapped — which vendors ship their own server, system by system, dated
- Self-hosted RAG platform for 800+ cooperative banks — a KRITIS-regulated platform on the operator's own OpenShift, with an MCP interface
- Claude Enterprise: posts on MCP and rollout — the rest of this series
What architects ask when a hosted MCP pitch is on the table
What is a hosted MCP server?
It is an MCP endpoint someone else runs for you. Your agent connects to one URL, and the provider handles authentication to the source systems, the connectors and the logging. Makini and CData Connect AI both work this way; CData calls Connect AI a managed MCP platform. A self-hosted server is the same protocol running inside your own network or cloud tenant, maintained by you or by whoever you pay to run it.
Can we use a hosted MCP server and a self-hosted one at the same time?
Yes, and for most industrial estates that is the sensible setup. An agent can connect to several MCP servers at once. A hosted gateway can cover SaaS maintenance and ERP systems while your own servers cover the historian, the MES and anything on the OT side. What must be consistent across both is the identity model and the audit log, or the agent answers under two different sets of rules.
What does each option cost?
It depends on the option, and two vendors do not publish prices. Makini's pricing page lists no figures and CData's AI page shows none. Microsoft bills 0.1 Copilot Credits per tool call when a client other than Copilot Studio, such as Claude, uses the Dynamics 365 ERP MCP server. A custom server starts with our two-week Readiness Blueprint at €4,900, and a first production server is usually a pilot from €15,000, net of VAT.
Can we start hosted and move to self-hosted later?
Yes, if you design for it from the first day. The agent sees tools, not hosting, so a migration is cheap when your prompts and workflows call named operations and expensive when they are written against a gateway's generic search and update tools. Keep a list of which tools each workflow relies on, and a move becomes a matter of reimplementing that list behind a new endpoint.
Does NIS2 or KRITIS forbid a hosted MCP server?
No law we have read bans a hosted MCP server outright. NIS2 lists electricity, gas and district heating among the sectors in its Annex I, which puts many energy operators in scope. A hosted gateway then becomes one more supplier with access to your systems, and your security team assesses it like any other. Several operators will reach a no for anything near the control system, and that is a risk decision, not a statute.
What does this comparison not cover?
It compares public statements, not tested deployments. We have not run Makini or CData Connect AI against a live system, and their public pages leave some points open, such as how Makini maps individual users to scoped credentials. We also sell custom servers, so weigh our verdict with that in mind. Before choosing, ask each provider the question on its card below and ask for it in writing.
Next step
Decide per system, before the first tool list is written
Two weeks, fixed price: one source system, a written test of whose identity each call can run under, and a recommendation on whether a hosted gateway, the vendor's server or a custom build fits it. Sometimes the answer is not us.