confcall MCP server

An MCP (Model Context Protocol) server exposing the confcall control plane — rooms, agent invite/status, transcripts, summaries, recordings — as tools, so an agentic host (Claude inside a CRM, a buyer's own orchestrator) can operate confcall without hand-rolling REST calls.

This server is a thin facade: every tool is a 1:1 wrapper over an existing confcall REST endpoint (see API Reference), using the same sk_ secret API key auth as any other server-to-server integration. It adds no business logic of its own — the REST surface stays the single source of truth.

Connect (hosted — nothing to install)

confcall runs the MCP server for you at https://mcp.confcall.app over streamable-HTTP. There is nothing to install or host — point your agentic host at the URL and send your own confcall sk_ key on every request. The hosted server holds no key of its own; it forwards your key to the REST control plane, so tenant isolation and rate limits are enforced by the confcall API itself.

{
  "mcpServers": {
    "confcall": {
      "url": "https://mcp.confcall.app",
      "transport": "streamable-http",
      "headers": { "X-API-Key": "sk_live_YOUR_CONFCALL_KEY" }
    }
  }
}

Exact config shape varies by client; the essentials are the URL, the streamable-HTTP transport, and the X-API-Key: sk_... header (Authorization: Bearer sk_... is also accepted). A request with no key is rejected with 401 before any control-plane call is made. The server is listed in the official MCP registry as app.confcall/mcp-server. Get a key from the confcall dashboard.

Self-host (optional — local dev)

Distribution is the hosted endpoint above; the stdio package lives in the repo for local development and is not published to a package registry. To run it yourself over stdio (a host that spawns it as a subprocess):

npm install
npm run build
CONFCALL_API_KEY=sk_live_... node dist/index.js

…or as your own streamable-HTTP endpoint: node dist/index.js --http.

Tool reference

Every REST call carries the key as X-API-Key — there is no separate MCP-level auth.

Every tool returns a structured MCP error result — never an uncaught exception — for any REST failure: { isError: true, content: [{ type: 'text', text: '{"error": true, "status": ..., "statusText": ..., "body": ...}' }] }.

Example agentic flow

1. create_room({ roomName: "Acme onboarding call" })
   → { roomId, embedUrl }
2. get_join_info({ roomId, externalUserId: "acme-user-42", role: "host" })
   → { token, expiresAt, embedUrl }   // hand this join URL to the user
3. invite_agent({ roomId, mode: "Notetaker", language: "en" })
   → { success, sessionId }
... meeting happens ...
4. list_sessions({ roomId }) → get_summary_and_actions({ sessionId })
   → summary + action items to push into the host's CRM
5. end_meeting({ roomId })

Known limitations

Every tool above is now fully authenticatable with an sk_ key against production — RFC-Builder-Onboarding-And-Docs Phase 1 extended the composite JWT/API-key scheme (and account-ownership checks) to RoomsController, ArtifactsController, and RecordingController, closing the gap this package's README originally flagged. One limitation remains, and it's architectural rather than an auth-wiring gap:

• end_meeting has no REST equivalent for force-ending a live call. Live-meeting teardown is VideoConferenceHub.EndMeetingForAll, a SignalR hub RPC — there is no REST route for it. This tool deletes the persistent room record instead, which is the closest REST-reachable analog.

Development

npm run typecheck   # tsc --noEmit
npm test            # builds dist/, then runs the vitest suite (unit + a stdio child-process
                    # contract test against the real built server)

Full source: mcp-server/README.md in the confcall repo.