Servers and clients

Create a server

From the server directory, start a server and give it a clear name and description. Each server has its own Tools, Prompts, Resources, and Connect views. The directory links directly to the selected server's Tools workspace.

Server definitions and capabilities belong to the authenticated workspace. Members share servers, workspace variables, and secrets; only the owner can invite or remove members.

Find the endpoint

Open the server's Connect view to see and copy the endpoint URL. MCPKite serves managed endpoints over stateless Streamable HTTP. Keep the endpoint path and trailing slash intact when configuring a client.

For example, the path may look like /mcp/<server-id>/. Use the exact path displayed by the app; do not infer a production hostname from local development.

Connect a client

Choose your client environment in the Connect guide and copy the endpoint in its recommended format. The base URL depends on where the client runs:

• A client on your host uses the host-facing origin shown by MCPKite, commonly http://localhost:8000 in local Compose development.
• MCP Inspector running in Compose uses http://backend:8000 followed by the server's displayed endpoint path.
• A hosted client uses the public HTTPS origin configured by the deployment operator.

For Inspector, open the authenticated launch URL from docker compose logs inspector. That URL contains a token, so keep it private. Add a Streamable HTTP server, enter the endpoint, connect, then inspect the available tools, prompts, and resources.

Protect an endpoint

To require bearer authentication, create a server token in Settings → Server tokens and assign it to the server. The token is shown only once. Store it securely before leaving the creation screen.

Clients connect to a protected endpoint with an Authorization bearer header containing that server token. This credential is separate from MCPKite account cookies and workspace secrets. Each token can be assigned to one server at a time; detach it before deleting it or assigning it elsewhere.

Switching a server to normal access detaches its token. Treat an unprotected endpoint as publicly reachable by anyone who can reach its URL.

Transport behavior

Managed MCP endpoints are protocol endpoints, not browser pages. A browser navigation GET is not an MCP request. Clients do not need to retain an MCP-Session-Id between calls, and the current generated tools do not keep per-client session state.

See Python tools, Prompts, and Resources for the capabilities a client can discover.