Connecting AI to older systems: tool calling, MCP and legacy software

The US Government Accountability Office (GAO) reviewed 69 federal legacy systems and reported in July 2025 that "the 11 legacy systems most in need of modernization are maintained by 10 federal agencies" [1]. A legacy system is an older system that still runs important work. The 11 were between 23 and 60 years old [1]. "Eight of the 11 systems use outdated languages, four have unsupported hardware or software, and seven are operating with known cybersecurity vulnerabilities" [1]. Both of the Department of the Treasury's selected systems run on COBOL and Assembly, programming languages that GAO says have "a dwindling number of people available with the skills needed to support" them [1].

Those are government systems. A large company with old software has the same task: the data and actions an AI tool needs live in that software. This page shows how often old systems block AI, how AI models call other software, how the Model Context Protocol works, and the patterns a large company can use. It is part of the guide on enterprise AI adoption.

How often old systems get in the way

Figure	Base	Source
41.6% named incompatibility with existing equipment, software or systems as a reason not to use AI	EU enterprises that considered AI, 2025	Eurostat [2]
37.99% named the same reason	Large EU enterprises that considered AI, 2025	Eurostat [2]
16.1% used AI to perform work previously done by existing software or equipment	US firms that used AI	Census Bureau [3]
15.6% did the same, and 48.8% did not know	US firms with 250 or more employees that used AI	Census Bureau [3]
15.0% used AI	Canadian businesses more than 20 years old	Statistics Canada [6]

The US figures come from the Census Bureau's AI supplement, collected 17 November 2025 to 8 February 2026. Because of Executive Order 14434, signed on 29 September 2026, the Census Bureau now calls AI "Super Intelligence" or "SI" in its files [4][5]. Its questions asked about "Artificial Intelligence (AI)" until the collection that began on 19 October 2026, after this supplement closed, so this page says AI [5]. At large US firms that used AI, 48.8% of respondents could not say whether it had replaced work done by older software or equipment [3].

Statistics Canada found that "Businesses that are more than 20 years old were less likely to use AI in the last 12 months, compared to younger businesses" [6]. The share for those businesses was 15.0%, against 18.4% to 25.0% for the younger age groups [6]. The survey does not say why.

The US National Institute of Standards and Technology (NIST) lists "checking compatibility with legacy systems" among the tasks of the people who deploy AI systems, next to "ensuring regulatory compliance, managing organizational change, and evaluating user experience" [12].

How an AI model calls other software

A large language model (LLM) produces text. To check an order, update a record or read a database, it needs a way to ask software to do the work. OpenAI, Anthropic and Google use the same basic design, called tool calling or function calling. The company describes the tools the model may use. The model replies with a request to use one, in a fixed format. Software then runs the request and gives the result back to the model.

OpenAI's guide says function calling shows "how you can connect a model to data and actions provided by your application" [9]. It describes five steps, and the third is: "Execute code on the application side with input from the tool call" [9]. Anthropic says Claude "returns a structured call that your application runs (client tools) or that Anthropic runs (server tools)" [10]. Google says that the model outputs which tool to call, and "Your application then executes this tool, feeds the result back to the model" [11].

Vendor	What the model returns	Who runs the call	Source
OpenAI	A tool call with its inputs	The company's application	[9]
Anthropic	A structured call	The company's application for client tools; Anthropic for its own server tools	[10]
Google	The tool to call and its inputs	The company's application	[11]

Read together, the three designs show that for tools the company defines, the model never touches the old system directly. The company's own code receives the request and calls the old system. That reading is this guide's, from the three vendors' documents [9][10][11]. That design lets the company decide what each tool may do, check every request before it runs, and keep a log.

The Model Context Protocol

The Model Context Protocol (MCP) is an open protocol for connecting AI applications to outside data sources and tools [7]. The latest version of its specification is dated 2026-07-28 [7]. Where tool calling defines tools inside one application, MCP gives a shared way to offer tools to any application that supports it, so one connector for an older system can serve several AI tools.

The specification says: "The protocol uses JSON-RPC 2.0 messages to establish communication between" three parts [7]. JSON-RPC is a standard message format for one program to ask another to do something. The three parts are:

• Hosts: the AI applications that start connections, such as a chat assistant.
• Clients: connectors inside the host application.
• Servers: services that provide context and capabilities, such as a connector to an order system.

An MCP server can offer three kinds of things: resources ("Context and data, for the user or the AI model to use"), prompts ("Templated messages and workflows for users") and tools ("Functions for the AI model to execute") [7]. MCP "takes some inspiration from the Language Server Protocol" [7], a standard that lets code editors work with many programming languages.

Two of the main vendors support it. OpenAI's built-in tools can "access the functionality of an" MCP server [9]. Anthropic offers an MCP connector: "Connect to remote MCP servers from the Messages API without a separate MCP client" [10]. MCP is now run as "a Series of LF Projects, LLC", and its project page says code and specifications are made available under the Apache License, Version 2.0 [8].

MCP has one limit a large company must plan for. The specification says: "While MCP itself cannot enforce these security principles at the protocol level", implementors should build consent and authorization flows and access controls into their applications [7]. Among those principles: "Hosts must obtain explicit user consent before invoking any tool" [7]. The page AI security risks for a large company covers why that matters.

Patterns for connecting AI to an older system

The table below is Reveneau's view of the common patterns, from the lowest risk to the highest. NIST's report on attacks against AI supports the general rule behind it: one defence is "allowing models to interact with potentially untrustworthy data sources only through well-defined interfaces" [13].

Pattern	What it is	When it fits	Main risk
Read-only tool	A tool that reads from an existing interface or a copy of the data	Search, summaries, answering staff questions	Exposing data to people who should not see it
Write tool with approval	A tool that changes records only after a person approves each change	Drafting updates, filling forms, preparing payments	A person approving without reading
New interface around the old system	A small service that gives the old system a modern, narrow interface, used by AI and other software	Systems with no interface the company can call	The new service is new code and needs its own tests
Replace a part	Rewrite one function of the old system, with tests	A function that blocks several AI uses	Breaking behaviour that nobody wrote down

In Reveneau's view, a company should start with the first row. A read-only tool over a defined interface lets a company learn what the AI does with real data before it can change anything. Move to write tools one action at a time, each with approval and a log. For agents that act on their own, read the guide on AI agents in production before the second row.

Connect first, or modernise first?

GAO's report shows how slow modernising first can be. The federal government spends more than $100 billion a year on IT and cyber investments, and GAO says agencies typically report spending 80 percent of it on operating and maintaining existing IT [1]. Of the 10 systems GAO flagged in 2019, agencies had completed three modernisations by February 2025 [1]. Two of the 11 systems in the 2025 report had no modernisation plan [1].

Reveneau's view is that a large company should connect first through a narrow, tested interface and modernise in steps, guided by what the AI work shows. A rewrite makes sense when the old system blocks several uses, and the interface built for the AI can then become the first piece of the new system. Whichever comes first, write tests before changing anything: an eval is a written, repeatable test of a system's answers against cases the company chooses, and the same idea applies to the old system's behaviour. The guide on forward deployed engineering covers the model in which engineers work inside the customer's own systems to do this work. The data side is on getting company data ready for AI, and the choice of who builds it is on build, buy or partner.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. Reveneau says it takes responsibility for the whole project through production and after release. To talk about connecting AI to an older system, see Reveneau's services or contact Reveneau.