Most articles about AI in business stop at demos. Chatbots answer questions, summarize emails, write marketing copy. Those things are useful, but they never touch the hard part: connecting AI to the systems actually running the business. That means accounting software, e-invoicing, inventory management, and ERP.
This article is about how we do that. Not theory. These are lessons from a system running in production (the real operating environment) every day, serving Vietnamese businesses. If you want a wider operational view, we have also written about the open-source stack we use to run the company.
Why is it hard for AI to talk to Vietnamese software?
The core reason is that Vietnamese software is rarely designed to let outside systems connect in. Across many of our projects (ERPFit internal data), accounting software, e-invoicing platforms, and ERP systems in Vietnam share three traits: complex web interfaces, limited or absent APIs, and multi-layered authentication.
When a business wants AI to check inventory, review receivables, or draft an invoice, there is usually no simple path. Commercial AI assistants like ChatGPT, Claude, and Gemini are strong at language, analysis, and code. But they cannot reach internal systems on their own. A business needs a middleware layer, a bridge, so AI can read and write data in the software already in use.
What is MCP and why does it solve this?
MCP is a standard protocol that lets AI call tools and interact directly with external systems. Model Context Protocol (MCP) is an open protocol developed by Anthropic that lets AI assistants call "tools" to work with outside systems.
Instead of copy-pasting data into AI, you grant AI direct, controlled access to real data. We built an MCP server infrastructure connecting to three groups of software common in Vietnamese businesses. The system now links around 10 groups of tools and services through MCP (ERPFit internal data), and that count keeps growing.
- ERP (business management). AI queries orders, inventory, receivables, and financial reports directly, instead of clicking through the ERP by hand.
- E-invoicing. AI looks up issued invoices, checks status, and creates drafts. The system supports four invoice types: VAT, sales, POS receipts, and electronic tickets.
- Accounting software. AI browses customer directories, vendors, inventory items, and vouchers. Numbers are aggregated across modules without opening each screen.
How does the architecture work?
We run a single HTTP server that serves multiple MCP services, each mounted at its own path. This multi-service approach avoids spinning up a separate server for every piece of software.
The first benefit is deploy once, serve many systems, with no extra processes or servers to manage. Next comes centralized authentication: users log in once and reach every service they are authorized for. Finally, extending the system stays small. Adding a new service means writing one module and mounting it at a new path.
The tech stack is deliberately minimal. The base is Bun (a TypeScript runtime), with exactly two external libraries, @modelcontextprotocol/sdk and zod. SQLite handles audit trails and session storage. No heavy HTTP framework, no ORM, no Redis. A service that must run 24/7 is better off with fewer moving parts. The same instinct drives how we monitor uptime with lightweight tools.
What are the real-world challenges?
The biggest challenge is that most software has no open API, so you have to connect another way. Here are three common problems and how we handle them.
Software without public APIs
Many Vietnamese applications offer no official third-party API, and the web interface is the only way to interact. We analyze the HTTP protocol that the webapp itself uses, then reproduce those requests server-side.
This requires analyzing network traffic to understand the internal API, handling complex authentication (cookies, CSRF tokens, custom headers), a Chrome Extension to capture login sessions from the browser, and automatic session storage and rotation. The approach is not ideal, but it matches reality. When software is not built for integration, this is the only path for AI to reach the data.
Sensitive data and access control
Accounting data, invoices, and customer records are all sensitive, so AI cannot have free rein. Every tool call is logged: who called it, which tool, what parameters, how long it took, and any errors.
Administrators can review the full history of AI interactions with the system. Authentication uses the user's real credentials, with no shared "admin key." AI only reaches the exact data that the user already has rights to on the source system.
Session expiration
Webapp sessions usually expire after a few hours. The system detects an expired session (via an HTTP 401 or a redirect) and prompts the user to log in again through the extension. There is no automatic renewal. That is a technical limit of working with webapps that lack refresh tokens (tokens that silently renew a session).
What can AI actually do in practice?
In live operation, AI has taken over lookups, aggregation, and drafting on real data. A few tasks run every day.
Users query inventory in plain language. Ask "Which products have the highest stock?" and AI queries the ERP and answers right away, with sorting and pagination. Receivables work the same way: ask "How much does customer A owe?" and AI pulls the figure from the accounting software and sums it across vouchers.
AI also drafts invoices from ERP data, though a human always confirms before official issuance. The last one is cross-system reporting. Instead of opening five different screens, AI gathers data from multiple sources into one clean report. That aggregation resembles the work behind syncing product data between PIM and e-commerce platforms that we have done before.
What lessons did we learn?
The core lesson is to open access for AI in stages, starting read-only and keeping humans on the critical decisions.
Start read-only
Do not grant write access to AI right away. Begin with lookups (read-only): view inventory, view invoices, check receivables. Once you trust the system, gradually expand to creating drafts and updating data. E-invoicing is the clearest example. AI can draft, but official issuance stays with a person.
Audit trails are not optional
When AI touches financial data, every action must be logged. This is not just for debugging. When something goes wrong, you need to know exactly what AI did, when, and against which data.
Keep dependencies minimal
Production systems need stability. Fewer dependencies mean fewer points of failure. The entire server uses just two external libraries, with everything else coming from the runtime itself. Updates never turn into dependency chaos.
Vietnamese software needs a different approach
Western integration patterns (clean REST APIs, OAuth, webhooks) rarely transfer as-is. Vietnamese software often has complex internal APIs, multi-layered auth, and thin documentation. The best move is to accept that reality and build a solution that fits, even when it is not "elegant" by the textbook.
What comes next?
MCP is growing fast, and more software will support the protocol natively. For Vietnamese business software, the integration path still needs someone who understands both sides, the AI platform and the business system. That is where ERPFit sits, and we keep expanding the number of systems AI can interact with.
If your business uses accounting software, ERP, or e-invoicing and wants AI to reach real data, this is the kind of integration we build every day. You can also explore our AI SEO service, the dulieu.dev data platform, and our Craft tools.