Agent Access Layer
A safe API and MCP server for your legacy module
The rewrite is a multi-year program, but the business wants an AI assistant that can look up an order, check inventory, or draft a quote this quarter. Those facts live in a VB6 application or an Access database that has no API and was never designed to be called by anything. Giving an agent direct database access is the fast answer and the wrong one: it bypasses every validation the application enforces, and nothing records what the agent did. We build the safe alternative.
What we do
A thin, well-tested service in front of one legacy module, in two layers plus the unglamorous parts:
- A conventional API. REST or gRPC, documented with OpenAPI, calling the module through its real code paths (or, for Access and FoxPro, through a data layer that enforces the same rules the forms did). Every operation is backed by a characterization test proving it matches what the legacy screens do.
- An MCP server. A curated set of tools on top of the API, designed for agent use: narrow inputs with validation, explicit read versus write tools, an allow-list of side effects, and descriptions written so a model uses them correctly. Authentication through your identity provider; per-user or per-agent scoping; every call logged to a store you own, with the arguments and the result.
- The operational work. Deployment to your environment (on-premises or cloud) with your secrets management, a runbook for adding a tool, rotating credentials and reading the audit log, and load and failure testing against the legacy module, which usually cannot handle concurrent callers and needs a queue or a lock in front of it. We build that too.
Who this is for
Companies whose system on these stacks will run for years yet, and whose owners need modern services and AI agents to call into it safely now: an integration nobody could build, an assistant that needs real data, a partner who needs an endpoint.
How we work with you
Discovery of the module's real behavior and the contracts worth exposing usually takes about a week. A first module typically takes four to eight weeks end to end, billed hourly on a time-and-materials basis; a second module on the same system usually goes faster, because the auth, logging and deployment are shared. Everything lands in your repository.
What it is not
- Not a migration. Nothing in the legacy code changes; it gets a safe front door.
- Not a chatbot project. We build the door; whoever builds the agent walks through it.
- Not a generic "AI integration" engagement. If your system already has a maintained API, you do not need this.
Next step
Contact us and describe the module: what it does, who needs to call it, and what must never happen. We will reply with how we would approach it.