A working ERP for a trading company, an MCP server that exposes its operations as tools, and an agent that runs the business under guardrails the system enforces: per-tool permissions, human confirmation for destructive actions, a full audit trail. Next.js 16, PostgreSQL 17.
**An ERP is the hard part. Letting an AI agent run it safely is the interesting part.** A working ERP for a small trading company, an MCP server that exposes its operations as tools, and an agent that operates the business through those tools under guardrails the system enforces rather than requests in a prompt.