1. How we got here
The five dates that took us from chatbots to coworkers, with the real citations.
From the 2017 transformer to now, AI moved from a brain in a jar (brilliant at text, unable to act) to something that can act. The unlock was reasoning plus tool use in a loop, made portable when Anthropic published MCP as an open standard in late 2024. Most people's mental model froze at ChatGPT in 2022, which is exactly why your techs and your customers underestimate what is now possible.
2. The agentic loop, properly defined
If you can onboard a level-1 technician, you already understand agents.
An agent is three things plus a loop: a system prompt (the employee handbook), a tool registry (the portal logins), and a task (the ticket). The loop reads the task, thinks, picks a tool, runs it, looks at the result, and goes again until it is done. The model never executes anything itself, the harness does, which is exactly where your controls live. Claude Code is this loop in a terminal, claude.ai is it in a browser, and a coworker like our Belle is it on a heartbeat with a memory.
3. Script, API call, or agent: choosing the rung
Agentic by default is overkill. The judgement about which rung to use is the product.
Write the steps down. If you can write them all, it is a deterministic script (effectively zero runtime cost). If you can write all but one judgement, it is a script with one cheap API call inside it. Only work you cannot enumerate earns a full agent loop. When an agent does the same task the same way three times, convert that path into a deterministic tool and take the model out of the runtime.
The full section covers the pattern vocabulary you will actually use (augmented LLM, chaining, routing, orchestrator and subagents, evaluator-optimizer, RAG, guardrails, skills) and the monthly cost levers: prompt caching, the Batch API, model tiering, an advisor pass, extended thinking, and evals before code.
4. Get your house in order
Build for yourself before you build for customers. Every mistake you make on your own tenant is a lesson, on a customer's it is an incident.
Start quietly and personally: a personal Claude subscription, one painful internal process, Git from day one. Put secrets in a vault from the first script, have the AI security-review what it builds and a human review what ships, and keep anything internet-facing behind allow-lists while you learn. Adopt the vendor gate now: every tool you buy must expose a public API with a published schema, because a closed platform is a black spot your AI cannot see.
5. The end state: what a finished build looks like
Before the how, the where. Every engagement, ours or a client's, converges on the same shape.
The build is four parts: data mapped into one source of truth, an ops and reporting portal (the business on one screen), an MCP server exposing your tools and AI search behind RBAC, and an agent that works on a schedule with human approval for anything irreversible. All of it deployed on infrastructure Claude stands up. Every month after, three recurring lines (hosting, portal and MCP maintenance, and Claude Teams seats) are the moat that makes you very hard to displace.
6. Build components: architecture, prompt, and what we learned
The quick-reference version of the build: for each major component, the best-practice architecture, a ready-to-run build prompt, the tips we earned, and where we tripped.
The full section walks eight components in depth: the company graph (data mapping), the ops and reporting portal, the MCP server, ticket-history search, a self-maintaining customer knowledge base, the AI coworker, secure development and hosting, and skills. Treat the architecture as the shape to aim for, not a stack you must copy.
7. The company graph
The single highest-leverage build in this entire guide, and it contains no AI at all.
Your customers exist in ten systems under ten different IDs. One object per customer maps every representation into a single queryable API, so one lookup resolves which services a customer has and hands back every ID for follow-up. Run the reconciliation early (agreements versus deployments versus billing) and it funds itself: every MSP we have done this with, ourselves included, found revenue leakage.
8. The MCP server playbook
How ours grew from 36 tools on a laptop to roughly 350 tools across 23 services in production, and the controls that made that safe.
Grow it in three steps: local first, then team behind your identity provider, then scale on demand. The six controls that matter are read/write demarcation in code, RBAC with a few roles, two-phase confirm on destructive tools, full audit, vaulted secrets, and allow-listing, alongside the token-efficiency work that controls both cost and accuracy.
9. Customer tenants: the GDAP architecture
The part most MSPs get wrong first.
Every AI-driven action in a customer tenant should be bounded by the same GDAP permissions Microsoft already enforces on your humans, and attributed to a named person. The guide walks the per-technician refresh-token vault flow, the double authorisation (your MCP's RBAC, then Microsoft's GDAP roles), and dual attribution across both audit trails.
10. Give the agent your memory
Your PSA holds years of solved problems. The built-in search cannot find them.
Summarise a year of real, time-logged tickets with a cheap model into cause, resolution, tags and customer, index them, and expose one search tool wired into every investigation. Investigations then start from "here is how we fixed this for this customer in March" instead of from zero, and retrieved content is always treated as untrusted input.
11. Skills: the way we do things
Base models decide how to work unless you tell them. Skills are your operations manual, written by doing.
Do one process the right way with the harness, then have it write a skill file so every tech and every agent does it identically next time. Share it to the team, measure adoption in the audit log, and update the skill whenever the process changes, especially after a failure.
12. Endpoint execution guardrails
Running AI-written PowerShell on customer endpoints through your RMM is the sharpest tool in this guide. Handle accordingly.
Vet every script before it runs (a second model pass, plus a human for anything write-capable), prefer read-only diagnostics first, constrain the language, and log every run like production code. The capability is real and your competitors will not skip it, so implement it carefully rather than avoid it.
13. Agent security architecture
The architecture that lets you move fast: deterministic guardrails around a non-deterministic core.
The front door is hostile, so never put a tool-using agent on the inbox: a cheap, no-tools pass classifies and screens for injection first. Wrap all external content as data not instructions, make privilege a ladder with identity (not just role) setting the ceiling, keep a human on the final step, and measure every reply's cost and every tool call.
14. The forward deployed engineering playbook
Everything above is a process you ran on your own business. FDE is walking the same process into your customers' businesses, as a recurring engagement.
The funnel runs from buying signals you already capture, to a paid discovery workshop, a feasibility report, a build day that ships something live, and then a monthly engagement. As the incumbent MSP you start from inside on trust, access and data, which is the hard part everywhere else. The guide includes the pricing we run, the pre-engagement access checklist, and our honest first-year lessons.
15. Running the structured meetings
The engagement is a sequence of meetings with software in between. Run them with the same discipline as the code.
Record and transcribe everything (with consent) so the transcript becomes the feasibility input, the roadmap, and the next quarter's pitch. Every meeting ends with something tangible, one hard number, and a priced next step. The guide scripts the discovery workshop, the build day, the stakeholder interviews, the quarterly review, and your own internal weekly sitting.
16. The prompt library
Copy, paste, adjust names. These assume Claude Code with access to your terminal and the relevant credentials in a vault.
Twelve ready-to-run prompts back the builds in this guide: an MCP tool from an API spec, the company graph, a reconciliation report, the actionable-tickets tool, knowledge base sync, turning a ticket into a skill, a prompt-injection screen, a security review pass, endpoint diagnostics, a feasibility report from a transcript, an adoption leaderboard, and making an agent cheaper.
17. Getting more out of Claude Code: the controls
The same task can be a two-minute skim or a rigorous, verified build depending on how you drive the tool.
The full section tabulates the controls (ultrathink, plan mode, ultraplan, effort levels, ultracode, subagents, skills, the review commands, and CLAUDE.md) and when each earns its keep. The habit that pays off most: plan or ultrathink before a big build, then run /code-review and /security-review after.
18. References and claims
The measured GCIT numbers behind this guide, the history citations, and how to reach us.
Headline results, all our own desk: 80% faster first response and 90% faster resolution (December 2025 to May 2026, published at gcit.com.au), triage classification at roughly $0.006 per ticket, and an MCP server grown from 36 tools to roughly 350 across 23 services. Every other company's result mentioned in the guide is an unverified industry reference, and the FDE pricing is the model we run and recommend, not a promise.
GCIT, 1/16 Dover Drive, Burleigh Heads QLD 4220. 1300 369 111. gcit.com.au/contact-us. If you are an MSP working through this playbook and you get stuck, reach out.