Laura Frederick, Founder and CEO of How to Contract, hosted this mini-course with Yelena Ambartsumian, Founding Attorney at Ambart Law. Yelena founded her firm two years ago to serve AI native and B2B SaaS companies building with AI, and she advises them on AI governance, AI product counseling, and their commercial agreements. She has represented both MCP providers and the enterprises buying from them, so she could show what each side has to build behind the contract language and where the two sides usually miss each other.
Want unlimited access to 110+ webinar replays? Our paid members get permanent access to webinar recordings from 2024 and 2025, plus 30+ hours of courses courses, certifications, and our massive expert library. If you just want an individual webinar, register in advance to get access to the recording for 14 days. You can sign up for our auto registration list so you are registered for every webinar we host. Learn more about our membership →
The conversation covered what MCP is and how it differs from the APIs underneath it, the three ways connected tools change a contract, and the license, retention, and data sharing terms that need to reach tool arguments and results. Yelena then took five real sentences from MCP usage terms that Laura had pulled for her checklist and paired each contract fix with the governance control that gives it effect. She finished with the programs providers and buyers each need to run, the handoffs between them, and how MCP changes the limitation of liability, indemnity, and logging terms we already negotiate for AI agents.
Here are our top ten takeaways from the speakers' comments during the webinar:
Treat every connector as a vendor relationship. Yelena called this the biggest mistake she sees. Procurement reviews every agent vendor carefully, and then a team turns on 20 connectors from a settings menu without the same review. Each third-party connector handles your client's data, and its publisher often isn't the vendor of the system it connects to. Diligence it the way you would a subprocessor.
List the tools your agent is allowed to use. With MCP, scope becomes tool access. Your authorized actions exhibit should name the servers, the tools, the permissions, and the data each one touches. Yelena wanted every tool and its plain language description approved and listed. Anything that isn't on the approved list isn't allowed.
Watch tool descriptions as closely as you watch the code. The model treats a tool description as an instruction. A server can rewrite a description after you approve it, which Yelena called the rug pull. Ask for version numbers for the server and each tool, a change log, and advance notice before any description, schema, permission, or price changes.
Expand customer content to cover what moves through connectors. Yelena defined customer content to include prompts, tool arguments, tool results, and anything the agent retrieves through a connector. Tool arguments are the blanks the model fills in when it calls a tool, and tool results are the data that comes back. Limit the vendor's license to performing the authorized actions through connectors on the inventory. Make sure the deletion clause doesn't wipe the audit logs you negotiated for.
Price agent activity on its own terms. A seat is a person who works a set number of hours. An agent runs all night, on weekends, and as five copies of itself when the task calls for it. Define what an agent instance means, including sub-agents launched by other agents. Give each agent its own scoped credential so the audit trail never shows a human doing what the agent did.
Make the audit log do double duty as the meter. Yelena said her one big takeaway was to negotiate metering and logging. Each call should record the timestamp, identity, tool, redacted inputs, unit consumed, and result, exportable to the customer's security and finance systems. Reconcile each invoice against your own logs the way you would a cloud bill. Vendors often hold logs for only a few months, so request the exports BEFORE they get deleted.
Swap vague usage standards for concrete settings. Nobody knows what commercially reasonable efforts to configure an agent means, and excessive usage has no accepted meaning either. Replace them with a maximum number of tool calls per task, a retry limit, a concurrency cap, and a per-agent budget. Reference those settings in the exhibit. The standard of care then becomes a configuration someone can audit.
Ask to see the control behind every clause. Yelena said the conversation with a counterparty is no longer about signing a clause. It's about showing the control that makes the clause true. She described promising a customer a warning before spend crossed a tier and then going back to her own client to ask who would actually send it. A promise needs a person or a system standing behind it.
Keep your exhibit and your host configuration in sync. A tool listed in the exhibit that the host blocks can't be used. A tool the host allows that's missing from the exhibit has no contract covering it. Triage connectors by what they can do, with light review for read-only tools and full review for anything that writes, sends, pays, posts, or deletes. Require a named person to approve anything destructive, irreversible, or external facing, and log that approval.
Revisit your liability and indemnity terms with connectors in mind. Most agent agreements carve data breaches and IP infringement out of the cap, and those carve-outs were drafted for harm the model caused on its own. The vendor will argue harm arriving through a connector was the customer's choice. A misuse-based indemnity also has to answer what happens when an approved connector gets compromised. Define error, misuse, excessive use, and security incident once and reuse those definitions in pricing, indemnity, and the limitation of liability.
Subscribe to Stay in the Loop
Our weekly newsletter keeps you current on upcoming How to Contract webinars and brings you recaps like this one when you can't make the live session. Subscribe now and get the practical takeaways delivered to you.
