- An MCP knowledge base exposes your company knowledge over the Model Context Protocol, so any MCP-compatible agent can query it through one standard endpoint.
- Build it in five steps: connect sources, keep their permissions, expose an MCP endpoint, give each agent identity and limits, and log every query.
- Govern agents like people: permission checks at retrieval, plus limits, human-in-the-loop on sensitive actions, and a kill switch.
- Do not copy data into a new index. Keep it where it lives so existing permissions stay intact; copying is the most common way these projects leak.
- Stand one up with npx @aivm/brain init, free to start, with your own model key and nothing you connect used to train a model.
To give AI agents a knowledge base they can query via MCP, connect your existing sources without copying the data, keep each source's permissions intact, and expose the knowledge base over a single MCP endpoint. Then give each agent a verifiable identity with limits and a kill switch, and log every query in a tamper-evident record. MCP, the Model Context Protocol, gives any compatible agent one standard way to ask, so you govern access in one place.
What is an MCP knowledge base?
An MCP knowledge base is a store of company knowledge exposed over the Model Context Protocol, so AI agents can query it through one standard endpoint instead of a custom integration each. MCP is an open protocol for connecting models and agents to tools and data, which means any MCP-compatible agent can ask your knowledge base questions the same way.
The value is consolidation. Rather than wiring each agent to Slack, Drive, and Notion separately, you expose one governed knowledge base for AI agents over MCP and let every agent reach it there. Because access flows through a single endpoint, you enforce permissions, limits, and logging in one place rather than re-implementing them per agent.
What you need before you start
Before building an MCP knowledge base, you need three things: the sources that hold your knowledge (Slack, Google Drive, GitHub, Notion and the like), a single sign-on identity so the system knows who or what is asking, and a model key. You bring your own model, so Claude, OpenAI, Gemini, or your own model can sit behind it, and nothing you connect trains it.
Identity is the foundation. AIVM Brain uses WorkOS single sign-on so the people and groups in your directory map straight in, and each company gets its own isolated tenant. With identity in place, an agent's query can be checked against real permissions instead of being trusted blindly.
Step 1: Connect your sources without copying the data
Connect the knowledge base to the tools where your knowledge already lives instead of bulk-exporting everything into a new store. AIVM Brain connects to Slack, GitHub, Google Drive, Notion, Box, Confluence, Salesforce, and Telegram with their permissions intact. Copying into a fresh index is the most common way a knowledge base for AI agents leaks, because the copy loses the access rules that protected the original.
Connecting rather than copying also keeps the base current. When a file's sharing changes at the source, the next agent query respects the new rule instead of serving a stale snapshot. The safest place for a document is where it already sits, with the permissions it already has.
Step 2: Keep each source's permissions
Map each source's existing access rules into the knowledge base so answers respect them. Before returning anything, the system checks the requester's identity against those rules (RBAC or ABAC), so a confidential file never lands in an answer for an agent that should not see it. This permission-aware retrieval, sometimes called governed RAG, is what separates a base you can safely open to agents from one that leaks.
Enforcement happens per request, per identity, at the moment knowledge is retrieved. Relevance still ranks results, but only within what that agent is cleared to read. Where a document is mostly safe but has one sensitive line, redact the single field instead of withholding the whole file, so agents stay useful without exposing secrets.
Step 3: Expose the knowledge base over an MCP endpoint
Expose the governed knowledge base over a single MCP endpoint so any MCP-compatible agent can query it. Because MCP is a shared protocol, you write the integration once and every agent reaches the same governed surface, rather than maintaining a separate connector per agent. The endpoint, not each agent, is where permissions and logging are enforced.
Keep the endpoint thin and the governance behind it. The agent sends a question, the brain resolves identity, checks permissions, retrieves only what is allowed, and returns a grounded answer. An MCP server set up this way is one controlled door into company knowledge instead of many ad hoc ones.
Step 4: Give each agent an identity and limits
Give each agent a verifiable identity instead of a shared key, then attach limits to it: rate limits, human-in-the-loop on sensitive actions, and a kill switch. ERC-8004, an Ethereum standard for trustless agent identity, lets each agent carry an identity the brain can resolve and check, so you know which agent asked and can hold it to its own rules.
Agents act faster and at larger scale than people, so an over-permissioned endpoint is a bigger risk with agents than without them. Per-agent identity plus limits means a misbehaving or compromised agent can be scoped tightly and shut off immediately, rather than taking the whole knowledge base down with it.
Step 5: Log every query so it is provable
Write every agent query, retrieval, and answer to a tamper-evident, content-blind audit log tied to the agent's identity. Content-blind means the record proves what happened without storing the content itself, so it is safe to share with auditors and no vendor can read your data through it. AIVM Brain can verify this log offline and optionally anchor a record of it on-chain.
Provenance completes the proof. AIVM Brain carries C2PA content provenance, the standard published at spec.c2pa.org, so each source and answer has a verifiable origin. Together, a content-blind audit and provenance turn can you prove what the agent accessed into yes, here is the record.
How do agents query the knowledge base once it is live?
Once live, an agent queries the knowledge base by sending a natural-language question to the MCP endpoint, exactly as it would call any other MCP tool. The brain resolves the agent's identity, checks permissions, retrieves only what that agent is cleared to read, grounds the answer in real sources, and logs the access. The agent gets an answer; you get a record.
Start read-only so agents can ask but not change anything, then grant write-back once the permission model holds. You can stand the whole thing up with one command, npx @aivm/brain init, free to start, and point your agents at the endpoint the same day.