What "plugs into your stack" means for AI agents

When a vendor says its AI agent "plugs into your stack", the claim should mean four concrete things. The agent calls your tools' APIs to read and change records, receives webhooks when something happens, gets access through OAuth with limited scopes instead of your password, and increasingly connects through the Model Context Protocol. Each is a published standard you can ask about by name.

The original version of this post boiled it down to three verbs, and they still work as a test. Read: can the agent see live context, such as the customer's history in the CRM or tomorrow's free slots? Act: can it do the thing, such as booking the slot or moving the deal stage, rather than suggest it? Write back: does the result land where your team looks, as a note on the ticket or a logged call? A chatbot that only reads is a search box, and one that cannot write back creates a second source of truth you will regret.

An API is the documented way one program asks another for data, or asks it to do something. HubSpot is a useful example because its documentation is public. Its API overview says every API sits under the same root path, https://api.hubapi.com/, and the current versions are named by date. Listing contacts looks like this:

GET https://api.hubapi.com/crm/objects/2026-09/contacts

When an agent "reads from the CRM", this is what happens underneath: a request like the one above, made with a token the business granted. When it "updates the deal stage", it sends a write request to the same API. If a vendor cannot tell you which endpoints its agent calls and with which permissions, the integration may be little more than a CSV export with a better name.

An API call is the agent asking. A webhook runs the other way: your tool sends an HTTPS request to an address the agent listens on the moment an event happens, such as a payment succeeding or a booking being cancelled. Stripe's webhook documentation is a clear reference. Stripe sends each event as a JSON payload over HTTPS, signs it so the receiver can check it really came from Stripe, and expects a quick 2xx response before any slow work starts.

The details on that page are exactly the questions to put to any vendor. Stripe retries a failed delivery for up to three days in live mode, does not guarantee that events arrive in the order they happened, and can occasionally deliver the same event twice, so a receiver should log the event IDs it has processed and skip repeats. An agent that books a slot on every webhook without that check will, one day, book twice.

OAuth 2.0, defined in RFC 6749, is the standard that lets an application obtain limited access to a service on a user's behalf. The RFC names four roles: the resource owner (you, granting access), the resource server (the tool that holds your data), the client (the agent's application) and the authorization server, which issues access tokens once the resource owner has approved.

The word that matters to a business owner is scope. Scopes are the list of permissions a token carries, defined by the service, so that, as HubSpot's documentation puts it, an app might be allowed to read contacts but not delete them. When you connect an agent and a consent screen appears, read the scopes and grant the narrowest set the workflow needs. That is how our custom agentic systems are set up: least privilege access, explicit action boundaries and an audit log of every action.

The Model Context Protocol is an open protocol for connecting AI applications to data sources and tools. The specification, in its 2026-07-28 version, describes three roles that exchange JSON-RPC 2.0 messages: hosts (the AI application), clients (the connectors inside it) and servers (the services that provide context and capabilities). Servers can offer resources, prompts and tools, and a tool is a function the model can call.

In practice MCP sits on top of the APIs above rather than replacing them. HubSpot's remote MCP server is a public example: the agent makes a tool call to the MCP server, the server makes the API request to HubSpot, and the result comes back as a structured response. HubSpot says it lets an agent read, write and update records such as contacts, companies, deals and tickets, and that the connection is made over OAuth.

For remote servers, the authorization section of the MCP specification builds on OAuth: a protected MCP server acts as an OAuth resource server, and the MCP client acts as an OAuth client, following the OAuth 2.1 draft. The specification's security principles also say hosts must obtain explicit user consent before invoking any tool, and that descriptions of tool behaviour should be treated as untrusted unless they come from a trusted server. That is the part to hold a vendor to. MCP makes connecting easy, so its permissions deserve the same scrutiny as any API key.

No vendor has a native connector for every tool, and anyone who claims one should be asked for the list. The honest setup is layered: direct API integrations for the systems the business lives in, such as the CRM, helpdesk and calendar, and an automation tool such as n8n, Zapier or Make for the long tail. Our post on AI automation tools for business operations compares that layer, and self hosting n8n on Google Cloud shows one way to run it on your own server.

The other half of the original argument also stands. A project that starts with "first, migrate everything to our platform" is slow, and the systems your team already knows are where the work happens. Your CRM, helpdesk, telephony and calendars stay where they are, and the agent works inside them with its own scoped access.

1. Which API endpoints does the agent call, and with which OAuth scopes?
2. Which events does it receive by webhook, and how does it handle retries and duplicates?
3. Can you show the agent reading live data from our CRM, not from a demo account?
4. Where does the data go, where does the agent run, and who owns the prompts and credentials?
5. When an action fails, who finds out, and where is it logged?

The same questions apply to voice and chat. Our voice agents and chat agents pages list what each one writes back to the CRM. The cost side of the decision is in AI voice agent vs a human receptionist, and the escalation side in when an AI agent should hand off to a human. More posts are in AI agents for business.