"Giving it tools does not mean AI will always use them in line with the intent.

That was the conclusion Musinsa Tech, the technology organisation of Musinsa, reached after adopting the Model Context Protocol (MCP) for a conversational product discovery service.

MCP is a technology that standardises how AI models connect to use external data and software functions. If a company builds an MCP server, AI can choose and call tools on the server for tasks such as product searches and document lookups.

But AI being able to access tools and using them as developers intend were different issues. Musinsa Tech said it went through more trial and error in controlling AI to turn user questions into accurate search conditions than in opening access to an MCP server.

The Musinsa MCP project began as an internal self-directed project in the fourth quarter of last year. User research based on an early prototype confirmed demand for asking multiple conditions at once, such as what to wear to a wedding this weekend and which black mesh sneakers have good reviews.

In existing online shopping search, users must directly select categories, brands and price ranges. Conversational AI can read the purpose, preferences and budget from natural-language questions and build search conditions on the user's behalf.

Musinsa Tech viewed conversational AI as a new product discovery channel and began developing a service that recommends its products inside ChatGPT. Rather than making purchase conversion an immediate goal, it focused on validating the potential of conversational product discovery and securing new customer touchpoints.

For example, when a user asked for clothes suitable for an April trip to Japan, it had AI search products by considering the season, destination weather and gender. For questions such as discounted items within a total budget of 300,000 won, the budget and discount status also had to be reflected in search conditions.

The problem was that user demands for fashion products were not standardised. Even the expression "minimal" can mean different styles depending on the person. A single question could include situation, weather, preferences, budget and exclusion conditions at the same time.

Existing product search APIs made it difficult to handle such demands sufficiently. Because product search APIs are designed around predefined conditions such as category, brand and price, some context can be lost or unintended conditions can be added as AI converts natural-language questions into search conditions.

◆MCP connection is not the end...AI control becomes a task

Such problems also occurred in the MCP connection method. Musinsa Tech said, "When users asked in natural language, AI sometimes sent to the MCP server irrelevant filters or bundling units that went beyond the intended range," and added that it tested various approaches, including refining inputs by passing them through another large language model (LLM).

It also tried a method in which another AI rechecks decisions made by AI, but it was difficult to guarantee consistent results. Musinsa chose to further tighten the input values AI can pass to the server, rather than trusting AI performance unconditionally.

It broke down input fields used for product search in more detail and changed the design so the MCP server could distinguish the intent of questions more specifically. Instead of giving AI broad discretion, it structured required conditions such as gender, price range, purpose of use, region and date and controlled them at the server stage.

Musinsa Tech said, "In the end, we solved the problem by breaking down the input fields much more finely, and controlling and identifying clearly at the MCP server what intent a user had in making a query," adding, "We struggled quite a bit to maintain consistent quality amid AI's non-deterministic characteristics."

◆Blocking access to personal data...applying the principle of least privilege

As AI agents access corporate systems, permission management is a separate task. From the development stage, only necessary functions and information should be allowed so AI cannot read or write unintended data.

Musinsa currently limits the scope of its MCP service to product discovery functions that can be used without logging in. Accordingly, the AI agent does not access users' personal information or payment and purchase data.

Even when it reviews authentication-based functions in the future, it plans to use only the minimum information needed for the service and to ensure users clearly recognise and choose the scope of information use. Musinsa Tech stressed that along with input validation, the "principle of least privilege" should be applied from the MCP design stage.

◆"Enterprise spread?...standardising authentication and security comes first"

In the industry, some point out that MCP's technical specifications and ecosystem are not yet mature enough for it to become a general-purpose standard. There are also concerns that the ecosystem could become fragmented because support methods differ by AI provider and client.

Musinsa Tech also saw a need for broader native support by major AI providers and for authentication and security standardisation. It judged that beyond connection specifications, authentication and permission management systems required in corporate environments must be in place for adoption to accelerate in earnest.

A Musinsa Tech official said, "Adoption in enterprise environments can accelerate in earnest only when most major AI camps support MCP natively and protocol-level authentication and security standards are in place."