@confcall/mcp-server

An MCP (Model Context Protocol) server exposing the confcall control plane — rooms, agent invite/status, transcripts, summaries, recordings — as tools, so an agentic host (Claude inside a CRM, a buyer's own orchestrator) can operate confcall without hand-rolling REST calls.

This package is a thin facade: every tool is a 1:1 wrapper over an existing confcall REST endpoint (see API Reference), using the same sk_ secret API key auth as any other server-to-server integration. It adds no business logic of its own — the REST surface stays the single source of truth.

Setup

npm install
npm run build

Over stdio (default, for a host that spawns the server as a subprocess):

CONFCALL_API_KEY=sk_live_... node dist/index.js

Or over streamable HTTP:

CONFCALL_API_KEY=sk_live_... MCP_TRANSPORT=http MCP_HTTP_PORT=3000 node dist/index.js

Variable	Required	Default	Description
`CONFCALL_API_KEY`	yes	—	A confcall secret (`sk_`-prefixed) API key. Never logged, echoed, or included in a tool result.
`CONFCALL_BASE_URL`	no	`https://meet.confcall.app`	The confcall REST host to call.
`MCP_TRANSPORT`	no	`stdio`	`stdio` or `http`.
`MCP_HTTP_PORT`	no	`3000`	Port to listen on when `MCP_TRANSPORT=http`.

Tool reference

Every REST call carries the key as X-API-Key — there is no separate MCP-level auth.

Tool	REST call	Notes
`create_room`	`POST /api/embed/rooms`	Creates an account-owned, embed-eligible room.
`get_room`	`GET /api/rooms/{roomId}`	Room metadata.
`get_join_info`	`POST /api/embed/sessions`	Mints a short-lived join token + embed URL for an external user.
`end_meeting`	`DELETE /api/rooms/{roomId}`	Deletes the room resource. Does not force-disconnect an in-progress live call — see "Known limitations".
`invite_agent`	`POST /api/rooms/{roomId}/ai-agent/invite`	`mode` (e.g. `Notetaker`) + `language` (STT pin).
`remove_agent`	`POST /api/rooms/{roomId}/ai-agent/remove`
`get_agent_status`	`GET /api/rooms/{roomId}/ai-agent/status`	Degrades to `{ agentPresent: false, available: false }` rather than erroring.
`list_sessions`	`GET /api/rooms/{roomId}/artifacts`	Summarized (not full-transcript) list.
`get_transcript`	`GET /api/artifacts/{sessionId}`	Full turn-by-turn transcript.
`get_summary_and_actions`	`GET /api/artifacts/{sessionId}`	Summary, outcome, decisions, follow-ups, action items.
`list_recordings`	`GET /api/recordings?roomId=`	`roomId` optional.
`get_recording_url`	`GET /api/recordings/{id}/stream`	Time-limited pre-signed playback URL (or a BYOS out-of-band reference).

Every tool returns a structured MCP error result — never an uncaught exception — for any REST failure: { isError: true, content: [{ type: 'text', text: '{"error": true, "status": ..., "statusText": ..., "body": ...}' }] }.

Example agentic flow

1. create_room({ roomName: "Acme onboarding call" })
   → { roomId, embedUrl }
2. get_join_info({ roomId, externalUserId: "acme-user-42", role: "host" })
   → { token, expiresAt, embedUrl }   // hand this join URL to the user
3. invite_agent({ roomId, mode: "Notetaker", language: "en" })
   → { success, sessionId }
... meeting happens ...
4. list_sessions({ roomId }) → get_summary_and_actions({ sessionId })
   → summary + action items to push into the host's CRM
5. end_meeting({ roomId })

Known limitations

Every tool above is now fully authenticatable with an sk_ key against production — RFC-Builder-Onboarding-And-Docs Phase 1 extended the composite JWT/API-key scheme (and account-ownership checks) to RoomsController, ArtifactsController, and RecordingController, closing the gap this package's README originally flagged. One limitation remains, and it's architectural rather than an auth-wiring gap:

end_meeting has no REST equivalent for force-ending a live call. Live-meeting teardown is VideoConferenceHub.EndMeetingForAll, a SignalR hub RPC — there is no REST route for it. This tool deletes the persistent room record instead, which is the closest REST-reachable analog.

Development

npm run typecheck   # tsc --noEmit
npm test            # builds dist/, then runs the vitest suite (unit + a stdio child-process
                    # contract test against the real built server)

Full source: mcp-server/README.md in the confcall repo.