MCP Servers for NestJS AI Agents: Tenant-Aware Tools for LangChain & LangGraph

AI agents are only as trustworthy as the tools you give them. LangChain wires the model; LangGraph owns the loop; MCP (Model Context Protocol) is how those agents discover and call your NestJS APIs as tools — search invoices, open tickets, read tenant config — without pasting a god-mode key into a prompt. If the MCP layer does not carry identity and tenant context, you have a chatbot with SQL access.

This guide is the implementation companion to our agentic-AI series: how to design MCP servers in front of NestJS SaaS, what tools to expose first, and how Cyber Infoware kits give you the gateway, SSO, and service boundaries those tools need.

Why wrapping the whole API as one tool fails

• A generic `http_request` tool lets the model invent paths, verbs, and other tenants' IDs
• Dumping OpenAPI into context overflows tokens and hides which calls are dangerous
• Agents retry failed writes and double-charge or double-email without idempotency
• Support cannot audit "which tool, which tenant, which user" if everything is raw HTTP

A practical MCP layout in front of NestJS

1. Identity first — MCP receives the user (or scoped service) JWT; it does not mint admin tokens
2. Narrow tools — `invoices.search`, `tickets.create`, `usage.summary` — not `callAnyEndpoint`
3. Tenant from the session — never from a free-text argument the model can hallucinate
4. Read vs write servers — split MCP processes so a research agent cannot see refund tools
5. Thin proxy — MCP validates args, calls NestJS, returns structured JSON (capped size)
6. LangGraph node — tool calls happen inside graph nodes with budgets, retries, and traces

LangChain vs LangGraph vs MCP (again, in one sentence each)

• MCP — the USB-C of tools: discoverable, typed, swappable across IDEs and agents
• LangChain — bind an LLM to those tools with schemas and parsers
• LangGraph — decide *when* to call which tool, loop, interrupt, or stop

What to expose first (and what to hide)

• First — search and read: tickets, docs, usage, invoice list (paginated)
• Second — low-risk writes with idempotency keys: create ticket, add comment
• Later / human-gated — refunds, role changes, data export, secret rotation
• Never as agent tools — raw SQL, shell, unrestricted file write, cross-tenant admin

If an agent can pick another tenant's id as a tool argument, you did not build MCP — you built a confused deputy.

Production checklist for MCP + NestJS

• Same RBAC as the HTTP API — MCP is another client, not a backdoor
• Rate-limit and circuit-break tool calls; agents retry harder than humans
• Cap result payload size; summarize server-side instead of returning 10k rows
• Log tool name, tenant, actor, latency, and outcome — never secrets in traces
• Version tool schemas; breaking JSON fields break every LangGraph worker
• Eval golden tasks: "list my invoices" must not leak Tenant B

SaaS-specific MCP tips

• One MCP server per domain (billing vs ops vs knowledge) matches microservice blast radius
• Workers and chat UIs should share the same MCP servers so behavior does not drift
• Pair write tools with your existing audit log — agent actions are still privileged changes
• Feature-flag new tools; supervisor/agent allowlists are product config

What "done" looks like

A LangGraph copilot searches invoices via MCP, NestJS enforces the JWT and tenant filter, a create-ticket tool is idempotent, and audit shows the actor. That is agentic AI on a real SaaS backend. Explore Cyber Infoware products or contact us for MCP design, agent architecture, or a NestJS foundation tools can trust.