MCP Server - Working with AI Assistants in ActivityInfo

00:00:01 Introduction to MCP servers

Alex begins by explaining what an MCP, or Model Context Protocol, server is. It is a technical framework that allows AI assistants to interact with external services. It functions similarly to an API, or Application Programming Interface, which allows two pieces of software to communicate, but the MCP server is specifically optimized to help AI agents and large language models access information services. ActivityInfo does not run its own large language model or perform AI processing directly. Instead, it provides information to an AI assistant that the user is already running, such as Claude, ChatGPT, Mistral, or Gemini.

He explains the mechanics of this interaction. While standard large language models simply predict the next word based on their training data, AI agents are trained to use external tools. For example, if asked for current information, an agent might use a web search tool to retrieve data and extract an answer. The ActivityInfo MCP server extends this capability by providing specific tools to the AI. These tools allow the agent to list the databases a user has access to, explore forms and fields, retrieve records, run pivot table analyses, design forms, enter data, build reports, and translate text. The agent may make multiple requests to the ActivityInfo server to find and compile the requested information.

Alex also clarifies the limitations of the MCP server. It does not grant the AI or any user access to data they do not already have permission to view. The server is turned off by default for all databases and must be explicitly enabled by a database administrator. Currently, the tools cannot read file attachments or manage user permissions and roles. Finally, because the AI operates based on user instructions, it is not recommended to run the assistant unsupervised or in the background.

00:05:29 Permissions and data security

Firas takes over to discuss permissions and data security, noting that ActivityInfo tracks highly sensitive personal data, such as names, GPS coordinates, and vulnerabilities. An AI assistant has no independent permissions; it acts entirely on behalf of the user who connected it. Every data request the assistant makes passes through the exact same permission checks as a manual click in the web browser.

There are two security gates that stand between the assistant and the data. The first gate is the database itself. The MCP server remains off for every database until an administrator explicitly turns it on. The second gate is the user's personal role. The assistant can only perform actions and view data permitted by the connected user's role. If two colleagues ask the assistant the same question about beneficiary totals, they will receive different answers if one is an administrator and the other has access limited to specific projects. Firas warns that the assistant does not know what data is hidden from it by the user's role; it treats what it can see as the entire database and answers confidently. Users must always verify what the connected account is actually allowed to see.

Firas emphasizes that "read-only" access is not a privacy shield. While it protects the database from being altered or deleted, the assistant can still read all text and personal data visible to that role. To stop an assistant, an individual can revoke its access in their account settings under authorized applications. To stop all assistants from reaching a database, an administrator can turn off the MCP server in the database security settings. To stop a specific person from accessing data entirely, an administrator must revoke their ActivityInfo user access. Revoking access stops future requests immediately, but it cannot undo changes already made or retrieve data that has already been sent to the AI provider.

It is critical to understand that the assistant does not run inside ActivityInfo. It runs on the servers of the AI provider, such as Anthropic or OpenAI. When the assistant reads data, that information leaves ActivityInfo and travels over the internet to be processed. This includes database names, form descriptions, actual text, personal data, analysis results, and the user's prompts. Unless specific legal and technical frameworks are established, users should assume their data remains in the provider's conversation history indefinitely and may be used to train future models. Training involves adjusting the model's internal numbers based on the text it reads, meaning sensitive beneficiary stories could become part of the model and theoretically be repeated to other users globally. Alex interjects to confirm this is a real risk, sharing an incident where an organization's email address appeared in a ChatGPT response generated for a user on the other side of the world.

Firas outlines six essential checks before connecting a database containing personal data. First, users must use a business or enterprise account, as personal plans often use conversations for model training and lack data processing agreements. Second, organizations must review the Data Processing Agreement to ensure the AI provider acts as a data processor under laws like the GDPR. Third, users must actively ensure their data is kept out of model training via the AI provider's settings. Fourth, organizations must check where the data is physically processed to comply with local data localization laws; for example, Mistral hosts data in the EU by default. Fifth, the principle of least privilege should be applied so the assistant only reaches necessary folders. Sixth, the organization must decide who is authorized to make the connection.

For highly sensitive data, such as health records or gender-based violence cases, Firas advises keeping the MCP server turned off entirely. If the six security checks are not met, users can still utilize the assistant safely through alternative methods. The first option is for design work: users can duplicate the database schema without copying the records, turn on the MCP server for the copy, use the assistant to generate dummy data to test form changes, and then manually apply successful changes to the original database. The second option is for analyzing non-sensitive data: organizations can create a dedicated role with access only to non-sensitive fields and use a service account to connect the assistant. Ultimately, security relies on organizational diligence, as anyone with access could theoretically copy and paste sensitive data into an AI chat manually.

00:19:54 Connecting the AI assistant

Firas explains the four-step process to connect an AI assistant to ActivityInfo, assuming enterprise licenses and security checks are in place. Step one occurs on the ActivityInfo side. An administrator opens the database settings, navigates to security, and turns on the MCP server, unlocking the first security gate.

Step two happens on the assistant's side. For platforms like ChatGPT or Claude, users can search for and add the ActivityInfo plugin. If the assistant requires manual setup, the user copies the ActivityInfo MCP address and pastes it into the assistant's integration settings.

Step three involves the second security gate. The assistant redirects the user to an ActivityInfo login page. The user signs in with the account they want the assistant to act as, whether that is their personal account or a dedicated service account. ActivityInfo then asks the user to grant either read-only or read-and-write access. Read-only is recommended unless the user specifically needs the assistant to create forms or enter data. This selection can restrict permissions but cannot grant access beyond what the user's role already allows.

Step four is testing the connection. The user opens a chat and types a simple prompt, such as asking the assistant to list their ActivityInfo databases. If the assistant returns the correct list, showing which databases are accessible and whether the MCP server is enabled for each, the connection is successful.

00:22:45 Best practices for prompting

Firas shares four habits for effectively prompting an AI assistant connected to a live database. Habit one is to always ask for a plan before letting the assistant act. Whenever asking the assistant to design or change anything, the user should end the prompt with the phrase, "Do not create anything yet." This forces the assistant to write a plain-text proposal in the chat without using its form-creation tools. The user can review the proposal and correct any misunderstandings in minutes, avoiding the time-consuming process of untangling a flawed database built by the AI.

Habit two applies to data analysis: always ask the assistant to show its work. Live databases often contain old forms, test records, and legacy data. If asked for a beneficiary count, the assistant might pull data from an outdated form but present the answer with absolute confidence. By asking, "Which forms and fields did you use? How did you calculate it?", the user can immediately catch mistakes or hallucinations. Important numbers should always be cross-referenced directly in ActivityInfo.

Habit three requires understanding how the assistant retrieves data. The assistant can either retrieve raw records or run a pivot analysis. Retrieving records pulls all the raw data into the assistant's context window. This works well for text or small datasets, but for hundreds of thousands of records, the context window overflows, causing the conversation to stop or the AI to hallucinate. Alternatively, a pivot analysis sends a calculation request to the ActivityInfo server, which processes the records and sends back only a small summary table. For totals, counts, and breakdowns, users should suggest a pivot analysis to prevent overwhelming the assistant.

Habit four is to make one structural change at a time. It is tempting to write a single, massive prompt asking the assistant to create multiple forms, add geographic fields, and set validation rules all at once. However, if an error occurs, the database may be left half-finished, making it difficult to identify which instruction caused the problem. Instructions should be given sequentially, and the user should verify the results in ActivityInfo before proceeding. Firas stresses extreme caution when asking the assistant to delete fields, as deleting a field in a relational database permanently deletes all the data contained within that field across every record.

00:27:52 Demonstration: Creating a database from a logframe

Firas conducts a live demonstration using a fictional hygiene project logframe aimed at reducing waterborne diseases. The project involves registering households, distributing hygiene kits, and conducting follow-up visits to check for soap and gather feedback.

Using Claude, Firas pastes a prompt alongside an image of the logframe. He asks the assistant to propose ActivityInfo forms for the indicators, state what one record represents for each form, list the fields, and map them to the indicators. He ends the prompt with the instruction not to create anything yet. Claude drafts a proposal, correctly identifying that the district field should be a reference list rather than free text, and outlines forms for registration and distribution. After reviewing the proposal, Firas enables the MCP server on an empty ActivityInfo database, provides the link to Claude, and instructs it to design the database. Claude successfully builds the forms, including reference data and household registration fields, ready for manual adjustments or further AI instructions.

00:31:06 Demonstration: Exploring database contents

While the first database is being generated, Firas demonstrates how to use the assistant to understand a database built by someone else. If a user inherits a complex database without documentation, they can ask the assistant to summarize its function and draw a simple diagram of its data model.

The assistant provides a summary explaining that the database tracks hygiene item distribution from registration to follow-up. It also outlines how the various forms are connected. This allows users to quickly grasp the relationships and fields within the database, enabling them to ask more specific, targeted questions afterward.

00:33:05 Demonstration: Context-sensitive translations

In the third demonstration, Firas addresses a database containing open-ended survey answers in French. While drop-down lists can easily be translated for data collection, open-ended text fields are difficult to analyze in a foreign language.

He asks the assistant to translate the French answers into English, emphasizing the importance of providing context, as specific words can have different meanings depending on the sector. The assistant processes the 45 French responses, adds a new field to the form specifically for the translation, and populates it with the English text while keeping the original French answers intact. This workflow allows teams to collect data in their local language, lock the form, and use the AI to translate the responses for easier analysis.

00:36:00 Demonstration: Working with qualitative data

Firas demonstrates how to categorize qualitative, open-ended data, a task that is typically very time-consuming to code manually. He asks the assistant to propose four to six tags for the newly translated English answers and to assign one theme to each answer by adding a new field.

The assistant suggests themes such as "content and quantity," "distribution organization," and "no specific comments." After Firas approves the plan, the assistant adds a multiple-selection drop-down field to the form and categorizes each response accordingly. Firas explains that users can then easily quantify this qualitative data directly in ActivityInfo by creating a pie chart of the themes and filtering out unhelpful responses, such as those with no specific comments.

00:39:12 Demonstration: Analyzing records and constructing reports

For the final demonstration, Firas asks the assistant to calculate the specific indicators defined in the original donor logframe. He prompts the assistant to explain which forms and fields it uses for the calculations and to create a report in ActivityInfo with one analysis per indicator.

The assistant fetches the necessary information and designs the indicators directly in the platform. For example, it creates a chart showing the percentage of monitored households with soap and water at their handwashing station. Firas demonstrates how users can refine the assistant's output, such as prompting it to use the district name field instead of the record ID for a report slicer, showing how easily the AI can adjust the analysis.

00:41:53 Advanced tips and data modeling artifact

Firas shares advanced methods for utilizing the AI integration. Users can save their organizational rules, naming conventions, and terminology definitions in features like Claude's Projects, Gemini's Gems, or ChatGPT's Custom GPTs. This ensures that everyone on the team starts from the same baseline when prompting the AI.

Users can also combine tools across different MCP connections. For example, the AI can pull data from ActivityInfo to update a donor annual report in Google Workspace, generate a slide deck in PowerPoint, or connect to external tools like Miro for drawing data models or Zapier for broader app integration. AI agents can also be given a single complex task and work autonomously through multiple steps and tools to complete it, provided all security checks are strictly followed.

As a bonus, Firas shares a custom Claude artifact designed by BeDataDriven. This tool turns a plain-text description of a program into a proposed data model. It asks the user a series of questions about their organization, sector, and workflow, and allows users to attach documents for context. It then generates a comprehensive document featuring a visualized data model, form-by-form suggestions, and sample datasets. Users can review this draft with their team before using the AI to build the actual collection tools in ActivityInfo.

00:47:02 Q&A session

Alex opens the Q&A session. Cecilia asks if the AI agent can be used to generate or revise translations. Firas confirms that it can, noting that providing context improves the translation quality. He recommends having a bilingual human double-check the results and reiterates the importance of not feeding sensitive data to the AI unless all security settings are configured. Cecilia also asks about the best AI models for ActivityInfo. Firas shares that he currently prefers Claude for complex analysis tasks, though Gemini works well within the Google Workspace. Alex adds that they have had success with Claude's Opus and Sonnet models, noting that the MCP tools are specifically optimized to use fewer tokens and make fewer mistakes compared to giving raw API access to coding tools.

Luis asks if there are connectors for locally hosted models to improve data security and accessibility. Alex confirms that because MCP is an open standard, it can connect to local models using tools like Open WebUI. This allows organizations to plug in any model, such as Mistral, and run it locally or within specific jurisdictions, addressing many of the data privacy risks discussed earlier.

Luigi from DRC asks if BeDataDriven plans to release pre-made skills that explain how ActivityInfo works to the AI, to save users from duplicating effort. Firas clarifies that the Claude artifact he demonstrated is backed by exactly such a skill, created entirely through prompting. Luigi also raises a concern about handling Personally Identifiable Information (PII), noting his organization uses service accounts to manually screen out PII fields before allowing AI access. He suggests a feature to flag fields as PII so AI users cannot see them. Alex agrees this is a critical need and discusses two potential pathways: creating specific role permissions for API and agent access, or adding metadata tags to fields (like a PII tag) and setting rules that automatically block AI agents from accessing tagged fields.

Another attendee asks if the free versions of AI providers yield different results. Firas notes that free tiers might not have access to the most capable models, which could affect the quality of the answers, but the basic MCP connection works on the free versions of both Claude and ChatGPT.

Majid asks if ActivityInfo can automatically flag records that violate MEAL rules, such as duplicate beneficiaries or impossible ages. Firas says the AI can be prompted to help write these validation rules. Alex adds that while the AI can check data after the fact, it is much more efficient to use ActivityInfo's built-in deterministic validation rules to prevent bad data entry in the first place. The AI's best application here is assisting the user in writing those specific rules.

Alexi asks if it is possible to connect the AI to the ActivityInfo audit log to query user actions. Alex notes they do not currently have a tool for that but thinks it is a great idea and makes a note to potentially add an audit log querying tool in a future update. The webinar concludes with thanks to the presenters and attendees.