MCP’s are fine

They are easy to implement and integrate

You can use OAuth and handle ACL easily