Model Context Protocol (MCP) Server FAQ Xvantage™

Summary:

A plain-language guide to Ingram Micro's MCP server: what it is, how to use it, and how it keeps your data safe.

Save time. Get answers without hopping between tabs, portals, and spreadsheets.
Reduce manual work. Automate repetitive lookups and small tasks.
Stay accurate. Pull live data from the source system every time.
Simplify multi-step work. Complete a chain of actions with a single request.
Focus on decisions. Spend less time gathering data and more time acting on it.

How do I get started?

Open the Integrations Hub in Xvantage and select the MCP tile. If you have a Developer Portal account whose email matches your logged-in Xvantage user, you can choose from a dropdown of the production apps assigned to your account and complete setup from there.

What if I don't have a Developer Portal account?

Register at Ingram Micro | Register for a Developer Account . Once your account is approved, return to the Integrations Hub to complete your MCP enablement.

Do I need to be technical?

No coding is required to use MCP — if you can ask a question in natural language, you can use it.

You will need someone (usually on your IT or integrations team) for the one-time setup: connecting the MCP URL to your AI assistant and configuring credentials.

What devices can I use it on?

Anywhere your AI assistant runs — desktop, laptop, tablet, or mobile.

Is there a cost to use MCP?

MCP is currently free to customers. If that ever changes, we'll communicate it in advance.

How Customers Use MCP

Which AI assistants work with MCP?

Any AI assistant that supports the MCP standard, including:

Claude (Anthropic)
ChatGPT (OpenAI)
Gemini (Google)
Microsoft Copilot
Cursor, Windsurf, and VS Code with Copilot
Your own internally built AI agents

If you're not sure whether your AI tool supports MCP, check its documentation — most major vendors have added support.

Can I use more than one AI assistant with the same MCP server?

Yes. The same MCP URL can be plugged into multiple AI assistants, as long as each supports the standard.

Either works. Most teams share a single MCP server at the company level and let the AI agents on top handle who can do what. If you'd like separate servers for different departments or environments, we can support that too.

How do I decide who in my company can use MCP?

You control this on your side — not ours.

The MCP server honors whatever your Ingram Micro API credentials can access. Deciding which of your employees can use the AI agent that talks to MCP — and what they can ask it to do — is handled inside your agent, your AI platform, or whatever tool the agent lives in. You set the rules that fit your business.

Can I automate things without a human in the loop?

Yes, but we recommend starting with human-in-the-loop approvals while you get comfortable. Once you trust how your agent behaves with MCP, you can move to unattended automation for low-risk, high-volume tasks (like checking order status or pulling invoice summaries).

For higher-risk actions, keep approval steps in place.

Can I build my own AI agent on top of MCP?

Yes — many of our customers do exactly that. MCP gives you a clean way to plug Ingram Micro data and actions into any agent you build, whether it's internal, customer-facing, or embedded in another product.

Can MCP connect to other vendors' systems too?

Other vendors (Microsoft, Cisco, HPE, and others) are building their own MCP servers. Your AI agent can connect to multiple MCP servers at once, which means it can orchestrate workflows across Ingram Micro and vendor systems in the same conversation.

What regions is it available in?

MCP is available globally. Specific endpoints and data may vary by region based on what each Ingram Micro business supports. If you have a multi-region setup, we'll walk through which credentials and endpoints apply to each region.

Security & Data Privacy

Is MCP secure?

Yes. MCP uses your existing secure APIs and respects the permissions already set on those APIs. Key controls:

Encrypted connections — TLS for all data in transit
Authentication on every request — no anonymous access
Audit logs across the MCP platform and the source Ingram Micro systems
Least privilege — the MCP server only gets access to what your agent actually needs

What is Workato, and how does it relate to MCP security?

We use Workato as the broker that handles MCP tool calls between your AI agent and Ingram Micro systems. Workato provides:

SOC 2 Type II compliance
Encryption in transit and at rest
Role-based access controls
Separation between development, test, and production environments
Run logs and alerting
Governance and versioning of recipes

On top of that, we apply our own safety prompts, guardrails, and least-privilege patterns.

How should I handle my MCP URL and credentials?

Treat your MCP URL like a password.

The MCP server URL includes an embedded authentication token — anyone with the URL can use it.
You can regenerate the URL (rotate the token) at any time. The old URL stops working as soon as a new one is issued.
Share the URL only with trusted people and systems. Don't post it publicly, drop it in shared chat channels, or commit it to public repos.
Use allow-lists or IP restrictions where your setup supports them.
Give the underlying credentials only the permissions your agent actually needs.
If you think your MCP URL has been exposed, regenerate it immediately.

How does MCP decide what I'm allowed to see or do?

Two layers:

Ingram Micro side. The MCP server exposes only the tools and endpoints enabled on your server, using the API credentials you configured. If your credentials can't access something in our systems, MCP can't access it either.
Your side. User-specific rules — "this salesperson should only see their own accounts," "this team can look up orders but not invoices" — are configured in your AI agent or the tool where the agent lives. Your agent knows who the end user is; MCP doesn't.

This split is intentional: it keeps MCP simple and lets you enforce your own policies the way they already work today.

Can I see what my AI agent is sending through MCP?

Yes. During pilots, we recommend turning on "always ask for permission before each tool call" in your agent — you'll see the tool name and arguments before each call runs, and can approve or deny each one.

Other options:

Leave parameter defaults blank. If you don't want Ingram Micro pre-filling certain request parameters, we can leave defaults off so your agent must send them on every call. This keeps control on your side.
Unattended mode. Once you're confident in how the agent behaves, you can turn off per-call approvals — but lean harder on logging and monitoring when you do.

Is my data shared with outside companies through MCP?

No. Data flows between systems you already use — your AI assistant and Ingram Micro's APIs — through the Workato broker. MCP and Workato are not a data warehouse; we don't store your business content. Your systems remain the source of truth.

One thing to be aware of: when you send a question to your AI assistant, that question (and the results MCP returns) passes through whichever AI provider you chose — Anthropic, OpenAI, Google, Microsoft, and so on. Each provider has its own data-handling policies. Review your AI provider's terms to understand how they handle your prompts and responses.

What happens to my data during an MCP request?

It's a standard API request and response:

You ask your AI assistant a question
The assistant determines which MCP tool to call
MCP authenticates and calls the Ingram Micro API with your credentials
Ingram Micro's system runs the request and returns the result
MCP formats the result and hands it back to the assistant
The assistant replies to you in natural language

Your data doesn't sit anywhere new. The system of record is still the underlying Ingram Micro platform.

Can MCP access systems I'm not authorized to use?

No. MCP uses the same authentication and authorization as the APIs underneath it. If your API credentials don't grant access, MCP can't get around that.

Is MCP less secure than using the APIs directly?

No. MCP sits on top of the same APIs with the same auth model. It adds a natural-language interface; it doesn't change the security posture underneath.

How long do you keep logs?

MCP run logs in Workato are retained on a rolling basis — typically 30 days of run history. If you have specific compliance or audit requirements and need longer retention, contact us.

Does MCP work with my SSO or federated identity?

MCP authenticates using the credentials on your Ingram Micro account — typically your Xvantage Developer Portal account (for hardware) or Marketplace API key (for cloud). SSO, MFA, and identity federation on your end happen inside your AI agent or the tool where the agent lives: the agent establishes who the user is, and MCP handles the call to Ingram Micro.

What MCP Can Do Today

Which endpoints are available as of July 2026?

Phase 1 is read-only. Create and write actions (like Order Create, Modify, and Cancel) are on the roadmap but not yet generally available.

Hardware (Xvantage Technology Solutions APIs) — GA, read-only

Product Search (catalog lookups)
Pricing & Availability
Product Details and Specs
Quote Details (view)
Order Status & Details (including shipment milestones and tracking)
Invoices (header and line summaries)

What credentials do I need?

Hardware endpoints: Xvantage Developer Portal account

How do APIs and MCP relate?

MCP is a natural-language interpreter layered on top of our APIs:

Your request → MCP translates → API call → Ingram Micro system → Response → MCP formats → You

The security and data flow are the same as calling the APIs directly. MCP changes how you interact with them, not what happens underneath.

Can MCP work with custom APIs?

Not today. Our MCP server exposes Ingram Micro's Xvantage APIs only. If you have custom APIs you want to tie in, your own agent can connect to those on your side — alongside its connection to our MCP server.

How is MCP different from traditional integrations?

Traditional integrations: custom-built, point-to-point connectors with high development and maintenance effort.
MCP: a standard interface, one connection pattern, natural-language input, and far less ongoing maintenance.

Practical Use Cases

What can MCP do for my team?

Sales. Pull customer context, check pricing and availability, view quotes, surface renewals.
Support. Order history, shipment status.
Operations & logistics. Check order and shipment status, inventory by location.
Finance & admin. Track invoice status and aging, pull billing summaries.

Can MCP handle multi-step workflows?

Yes. Start with simple one-step lookups while you get comfortable, then move to orchestrated multi-step flows as your guardrails mature.

Example: "Find all renewals expiring in Q3 for Acme Corp, show me the ones over $50K, and pull the related customer contact details." Your agent chains those three MCP calls together in one request.

How does MCP improve daily work?

Fewer tabs and exports. Faster answers. Single-prompt snapshots. Less time switching between systems to assemble information manually.

Understanding AI Responses

Can I trust the answers?

The data comes from Ingram Micro's live systems — the same systems of record your team uses today. Accuracy depends on the source data being current, which it is for the vast majority of endpoints (real-time or near real-time).

If the AI adds commentary or interpretation on top of the raw data, verify that part the same way you would any AI-generated content.

What if the AI doesn't understand my request?

It will usually ask a clarifying question or tell you what information it needs. Rephrase, add specifics, or provide an ID where possible.

What if I ask for something MCP can't do?

You'll get a clear message — unsupported action, missing permissions, missing required field, or out of scope. It's the AI's responsibility, not MCP's, to determine what information to share when it cannot provide an answer.

How do I know the information is current?

Every call retrieves live data. The information provided through the API should be up-to-date.

Rollout and Adoption

Who uses MCP? Is it proprietary?

MCP is an open standard originally popularized by Anthropic and now adopted by major AI vendors, developer tools, and enterprises. There's no lock-in — if you change AI assistants later, you keep your MCP setup.

What training do my users need?

Very little. The best results come when users know:

Which systems are connected
What kinds of data and actions are supported
How to be specific in their prompts (include IDs, dates, names, and so on)

What do I need in place before go-live?

An AI assistant or agent that supports MCP (Claude, ChatGPT, Gemini, Copilot, Cursor, Windsurf, VS Code, or your own)
Ingram Micro credentials for the tracks you want to use (Developer Portal for hardware, Marketplace API key for cloud, or both)
A named business owner for prompt patterns and first-line questions
An understanding that Phase 1 is read-only

Hard stops: no AI agent, or missing credentials.

Can I pilot with a small group before rolling it out widely?

Yes — and we recommend it. Most customers start with a small team, tune their prompts and guardrails, then expand.

Support and Troubleshooting

Who do I contact if something goes wrong?

Start with XI Support through your standard channels. They'll triage and loop in XI Product if needed. When you reach out, share:

What you asked the AI
What you expected vs. what you got
Roughly when it happened
Any error text

MCP is slow or not responding. What should I do?

Check your own network and AI assistant connection
Simplify or rephrase the request
Contact XI Support if it persists

Slowness often comes from the source system rather than MCP itself, so the first check is worth doing.

How often is MCP updated?

Continuously. Most updates — performance fixes, new features, schema improvements — are seamless to customers.

Tip: If you're told a tool update requires it, regenerate your MCP URL from the Integrations Hub and update it in your AI assistant to make sure your agent is using the latest tool set.

Can I request new capabilities or integrations?

Yes. Submit the request through XI Support, the Integrations Hub, or your account rep. Include the use case, the value it would unlock, roughly how many users would benefit, and how urgent it is.

Tips for Better Results

How do I get the most out of MCP?

Be specific. Include IDs, date ranges, and customer names.
Start simple. Prove the basic lookup works, then build up to multi-step flows.
Give context. Tell the AI what outcome you're trying to reach, not just what data to pull.
Use follow-ups. Refine as you go — most AI assistants maintain context within a conversation.
Specify the format. Ask for a table, a summary, or a list if that's what you want.

Common pitfalls to avoid

Vague requests that force the AI to guess
Asking for actions MCP doesn't support yet (like "create this order" — that's coming, but not available today)
Skipping verification on critical steps
Assuming MCP can override your permissions (it can't — and shouldn't)
Storing your MCP URL somewhere insecure