How does an MCP server work?

A server tells each client what it offers. Tools are actions with a name, a description and a JSON Schema for their inputs. Resources are data such as a file or an API’s documentation, and prompts are templates a user can choose. The model reads the tool descriptions and picks one, and the client sends a tools/call request with the arguments.

A local server starts as a process on your computer and talks over stdio, usually to a single client. A remote server listens at one HTTPS endpoint, uses the Streamable HTTP transport and serves many clients. Remote servers usually require authentication: the transport supports bearer tokens, API keys and custom headers, and MCP recommends OAuth for getting tokens.

The specification requires every server that uses Streamable HTTP to check the Origin header on each incoming connection and refuse an invalid one with 403. That mainly stops a website using DNS rebinding to reach an MCP server running on your own computer.

For example, a database server might offer a run_query tool and expose table schemas as resources. Asked how many sign-ups came in last week, an AI assistant reads the schema and runs one query.

Sources

Why does an MCP server matter for a website voice agent?

A voice agent product with an MCP server can be set up from the tools your developers already use. A coding agent can read your docs, draft knowledge and instructions, and add the install snippet to your site, while a person approves what goes live.

The server’s tool list is also its permission list. Read it before you connect, because it’s everything an AI client can do with your token, and give each client its own token so you can revoke one without affecting the others.

How Kawl Now’s MCP server works

Kawl Now’s MCP server is at https://app.kawlnow.com/api/mcp. It uses Streamable HTTP and accepts only POST requests, so a GET returns 405. Each JSON-RPC message is its own request carrying your workspace token as a bearer token, and each request gets a single JSON reply rather than an event stream.

It supports protocol version 2026-07-28, with the request headers that version requires, and the 2025-11-25 initialize handshake for older clients. Instead of OAuth, you create a token under Developers in the dashboard and add it to your client’s headers. A request carrying another website’s Origin header is refused with 403.

Its tools include get_workspace, update_agent, add_knowledge, sync_github, list_knowledge, get_knowledge, approve_knowledge, list_conversations, get_installation and conversation_insights, which reads the automatic insights for support or sales. import_website is listed but switched off, and returns an error.

MCP client config from the Developers tab, with a placeholder token
{
  "mcpServers": {
    "kawl-now": {
      "url": "https://app.kawlnow.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_WORKSPACE_TOKEN"
      }
    }
  }
}

Common questions

Do MCP servers run locally or in the cloud?

Both. A local server runs as a process on your computer and talks over stdio, usually to one client. A remote server runs at an HTTPS endpoint and uses Streamable HTTP, so many clients can connect to it with a token or through OAuth.

Is it safe to connect an MCP server?

It depends on the server and the access you give it. Connect servers you trust, read their tool lists, give each client its own token and use your client’s approval settings for tools that change data. The MCP specification treats tool descriptions from untrusted servers as untrusted.