How is MCP different from an API?
An API is one service’s own interface. MCP is a shared protocol for offering capabilities to AI applications: a server describes its tools with names, descriptions and JSON Schema inputs that any MCP client can discover and call. Many MCP servers wrap an existing API in this form.
Is MCP only for Claude?
No. Anthropic created MCP, but it’s an open standard now hosted by the Linux Foundation’s Agentic AI Foundation. The MCP project lists support in Claude, ChatGPT, Visual Studio Code, Cursor and many other AI applications and developer tools.
Do MCP servers run locally or in the cloud?
Both. A local server runs as a process on your computer and talks over stdio, usually to one client. A remote server runs at an HTTPS endpoint and uses Streamable HTTP, so many clients can connect to it with a token or through OAuth.
From What is an MCP server? Local and remote servers explained
Is it safe to connect an MCP server?
It depends on the server and the access you give it. Connect servers you trust, read their tool lists, give each client its own token and use your client’s approval settings for tools that change data. The MCP specification treats tool descriptions from untrusted servers as untrusted.
From What is an MCP server? Local and remote servers explained
Is a REST API the same as an HTTP API?
Not strictly. REST is an architectural style with specific constraints, while any API that runs over HTTP is an HTTP API. In everyday use the terms overlap, because most HTTP APIs with resource URLs and standard methods are called REST even when they skip constraints such as hypermedia links.
Do you need an SDK to call a REST API?
No. A REST API takes ordinary HTTPS requests, so curl or any language’s HTTP client can call it. An SDK only wraps those requests in functions for one programming language.
How does an SDK differ from an API?
An API is the interface a service exposes, such as its REST endpoints. An SDK is a kit for using it, usually a client library for one programming language plus documentation and examples. You can always call an API without its SDK.
Do you need an SDK to add a voice agent to a website?
Not always. Some voice agents are built on a vendor’s SDK, while others, including Kawl Now, install with a script tag and need no SDK.
Is OpenAPI the same as Swagger?
Not any more. The OpenAPI Specification was formerly the Swagger Specification, which SmartBear donated in 2015. Swagger is now SmartBear’s set of open-source tools built around OpenAPI, such as Swagger UI and Swagger Editor.
Should an OpenAPI file be JSON or YAML?
Either works. The specification allows both formats for the same structure. JSON is easy for programs to produce, while YAML is easier to read and edit by hand.
How is a webhook different from an API?
With an API, your code sends a request when it wants data. With a webhook, the service sends a request to your code when something happens. Many services offer both: an API for reading and changing data, and webhooks to tell you when to look.
Is an API key the same as a password?
They’re both secrets, but an API key is for a program rather than a person. It works without a second factor and often lasts until it’s revoked, so keep it out of code you commit and store it where only the program can read it.
From What is an API key? How keys work and where to store them
Where should you store an API key?
In server-side configuration, such as an environment variable or a secrets manager, readable only by the code that needs it. Never put a secret key in front-end code, a URL or a file you commit.
From What is an API key? How keys work and where to store them
Is a bearer token the same as a JWT?
No. A JWT is a token format that carries signed claims, while bearer describes how a token is used: whoever presents it gets access. A JWT is often sent as a bearer token, but a bearer token can also be an opaque random string, as Kawl Now’s workspace tokens are.
From What is a bearer token? How bearer authentication works
Can a bearer token go in a URL?
It shouldn’t. RFC 6750 says bearer tokens should not be passed in page URLs, because browsers, servers and logs can record them. Send them in the Authorization header over HTTPS.
From What is a bearer token? How bearer authentication works
Is CORS a security feature?
Partly. CORS relaxes the browser’s same-origin policy in a controlled way, deciding which web pages can read a server’s responses. It doesn’t stop requests from servers, scripts or tools outside a browser, so an API still needs authentication.
Why does an API request work in curl but fail in the browser?
Because only browsers enforce CORS. curl ignores it, while a browser blocks a cross-origin response unless the server sends Access-Control-Allow-Origin for your page’s origin. The browser console shows the specific CORS error, which page scripts can’t see.
How do you add the embed code to your website?
Paste it where the provider says, usually just before the closing </body> tag or inside the <head>. Site builders usually offer a custom code setting for this, and a shared template puts the snippet on every page at once.
Is it secure to add embed code to a website?
Only from providers you trust. A script tag runs with the same access as your own code, so it could read or change the page. Prefer embeds that keep secrets on the provider’s server, and use a Content Security Policy to limit where scripts can load from.
Is a work email address personal data?
Yes, when it identifies a person, such as jane.smith@example.com. The ICO says a name and a corporate email address clearly relate to a particular individual. Information about a company itself, rather than a person, isn’t personal data.
From What is PII, and how does it differ from personal data?
Is a voice recording personal data?
Yes, if it can be linked to the person speaking, and it’s biometric data under the GDPR when it’s processed to identify them uniquely. Kawl Now doesn’t record call audio. It keeps a text transcript instead.
From What is PII, and how does it differ from personal data?
How does a data controller differ from a data processor?
The controller decides why and how personal data is processed and carries most of the legal responsibility. The processor acts only on the controller’s documented instructions, under a contract the GDPR requires.
Does a data processor need permission to use a sub-processor?
Yes. Under Article 28 of the GDPR, a processor needs the controller’s prior written authorisation, specific or general. With a general authorisation, it has to tell the controller about any new or replaced sub-processor, so the controller can object.
Does GDPR apply to companies in the UK?
UK organisations follow the UK GDPR and the Data Protection Act 2018, enforced by the Information Commission, still known as the ICO. A UK company that offers goods or services to people in the EU, or monitors their behaviour, may also have to comply with the EU GDPR for that processing.
From What is GDPR? UK and EU data protection rules explained
Does GDPR require data to stay in the EU?
No. GDPR doesn’t require data to stay in one place. It restricts transfers outside the EU, or outside the UK under the UK GDPR, unless they’re covered by an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific exception.
From What is GDPR? UK and EU data protection rules explained
Is data residency the same as data sovereignty?
No. Data residency is where data is stored and processed. Data sovereignty is the idea that data is subject to the laws of the country where it’s held, so choosing a location also brings that country’s laws with it.
From What is data residency? Residency vs sovereignty and GDPR
Can a SaaS vendor guarantee UK data residency?
Only for the parts it controls. A vendor can keep its database in the UK, but other services it uses, such as an AI model provider, may process data elsewhere. Ask where every step runs and which safeguards cover any transfer.
From What is data residency? Residency vs sovereignty and GDPR
Does row-level security replace access checks in the application?
It shouldn’t. RLS works only with correct policies and a database role that’s subject to them, so application code should still scope its queries, and tests should check both layers.
Does row-level security slow queries down?
It can, because the policy condition is checked against each row a query considers. Keep policy expressions simple and index the columns they filter on, as Supabase’s documentation recommends.