MCP-first reorders the classical priority sequence. Not the interface stands at the center, but a central layer of actions, resources, and workflows that is used equally by all interfaces.
The new priority
Previously, the web app came first, followed by API and automation. MCP-first reverses this: domain, actions, and policies first, interfaces are the clients.
Klassisch
- Webapp
- Mobile App
- Admin UI
- API
- Automation
- AI-Integration
MCP-first
- Domain Model
- Action Layer
- Permission Layer
- MCP Tools
- MCP Resources
- MCP Workflows
- Audit Layer
- Webapp · Mobile · Admin · API · Automation
Target architecture
The architecture consists of six layers. Human and agentic interfaces sit at the top, the capability layer forms the heart, with security, domain, and data below.
Core rule
Business logic must not live in the web app. Business logic must not live in the MCP server.
Why this enforces better architecture
Whoever builds MCP-first must automatically model more cleanly:
- clear domain actions with unambiguous user intent
- typed input and output schemas
- clear permissions, error cases, and side effects
- clearly defined audit events and protection levels
This is not just good for AI. This is good software architecture.
Central policy engine
All interfaces use the same decision function:
can(user, action, resource, context)This means there is no second, diverging permission logic in the MCP server or in the web app, only a single source of truth.