Repository navigation
docs: connect the hosted MCP server by signing in, not with an API key - #1411
Closed
chris-garber-vapi wants to merge 7 commits into
Closed
chris-garber-vapi wants to merge 7 commits into
chris-garber-vapi wants to merge 7 commits into
Conversation
Make connecting to the hosted Streamable HTTP server the primary path and running the server locally the secondary one. Fold the duplicate "Integration Options" and custom-client sections into "Run the server locally" and "Use the server from your own code", mention the deprecated SSE endpoint only in the migration note, and list docs search among the core tools. Reword the CLI overview bullet to "Turn your agent into a Vapi expert". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Carry over the useful part of #1409: agents that only need docs search can connect to https://docs.vapi.ai/_mcp/server (searchDocs, no API key), with an mcp-remote example for clients that need a stdio adapter. Link it from the migration note, since it is the like-for-like replacement for the retired @vapi-ai/mcp-docs-server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
🌿 Preview your docs: https://vapi-preview-01a1c6a4-1811-744a-a6bf-bbec624ef6d2.docs.buildwithfern.com |
The tools table listed 11 of the 29 tools the server registers, and the MCP tab rendered no sidebar. Tools: the hosted server pins @vapi-ai/mcp-server 0.1.0 and registers all of its tools, so hosted and local expose the same 29. The 18 that were missing are update_assistant, create_tool, update_tool, get_api_schema, search_skills, load_skill and the 12 simulation tools. Descriptions come from the tools' own registered descriptions. Grouped the table by area, since one flat 29-row table is hard to scan, and dropped the invented "Example usage" column. Sidebar: #1396 moved tools/mcp.mdx out of the MCP tab into the Documentation tab, leaving the tab with a single page. Fern renders no sidebar for a tab with one entry, so #fern-sidebar was display:none on this page while every other tab was display:flex. Adding a link back to MCP tools restores the sidebar and the cross-link #1396 removed. Verified against a local fern docs dev server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
chris-garber-vapi
force-pushed
the
claude/mcp-oauth-docs-2ed49c
branch
from
November 10, 2026 18:56
9f648d5 to
ba86934
Compare
chris-garber-vapi
changed the base branch from
claude/mcp-server-hosted-first
to
claude/mcp-tools-table-sidebar
November 10, 2026 18:56
Contributor
|
🌿 Preview your docs: https://vapi-preview-01a1c6d3-0da1-7113-8faf-de410e25ad9b.docs.buildwithfern.com |
chris-garber-vapi
changed the base branch from
claude/mcp-tools-table-sidebar
to
claude/mcp-server-hosted-first
November 10, 2026 19:13
Contributor
|
🌿 Preview your docs: https://vapi-preview-01a1c6ec-6fa9-74a2-85cd-8207ab94f676.docs.buildwithfern.com |
Address stephenvapiai's review on #1410: - Name every agent tab plus tools and simulations in the page description, which feeds llms.txt. - Lowercase "server" in the title and body to match the nav label and the rest of the docs. - Trim the "Replacing an older setup?" callout to two sentences and lead with why the reader needs to act. - Rename "Core tools" to "Available tools", since the section now lists every tool. - Use the simulations docs' own term, "AI tester", in place of "scripted callers", "simulated callers", and "testers". - Correct the run_simulations note: simulations don't place phone calls, but each run is billed. - Move the create_call real-call warning into its own Info callout. - Avoid starting sentences with code identifiers. - Say "coding agent" in the CLI overview, since "agent" alone reads as a voice agent elsewhere in the docs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The hosted MCP server at mcp.vapi.ai/mcp becomes OAuth-only at the Nov 10 cutover: it stops accepting Vapi API keys in an Authorization header and stops serving /sse. - rewrite the six agent tabs to add the URL alone and sign in, using each client's own OAuth path (codex mcp login, claude mcp login, hermes auth: oauth, bare url for Cursor and VS Code, Claude Desktop custom connector) - add "How signing in works": the agent acts as the signed-in user with that user's role, one org per connection, get_connection_info to check it, and the actions Connect tokens can never reach (API keys, credentials, billing) - replace the SSE deprecation note with an upgrade note covering what to delete from an existing config - note that the local stdio server still uses VAPI_TOKEN, which makes it the option for unattended automation - rework "Use the server from your own code": mcp-remote as the simple path, SDK OAuth helpers, and an access token rather than an API key in the Node examples; drop the OpenAI example that passed an API key - add get_connection_info to the tools table Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dropping this example in the OAuth rewrite left the page with no Python or TypeScript sample, which #1410 had. Restoring it keeps that coverage. The old example passed `headers: {"Authorization": "Bearer <api key>"}`. That was wrong twice over: the Responses API takes an `authorization` field and has no `headers` field, and the hosted server no longer takes API keys. The restored example uses `authorization` with an access token from the sign-in flow, and notes that the token is short-lived and that the API asks for approval unless `require_approval` is set. Also updates the OpenAI docs link, which now redirects to developers.openai.com/api/docs/guides/tools-connectors-mcp. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Address stephenvapiai's review on #1411: - Point the Overview at "How signing in works" instead of describing the browser flow twice. - Give the Claude Desktop connector setup a Steps block, so each step is numbered and linkable. - Promote the upgrade callout to its own "Upgrade from API key authentication" section. It held required steps, which don't belong in a callout, and it now appears in the right-hand nav. - Split the sign-in, 401 challenge, and access token paragraphs into one idea per sentence. - Fix the MCP authorization spec link, which 404s without a version segment in the path. - Avoid starting a sentence with a code identifier. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
chris-garber-vapi
force-pushed
the
claude/mcp-oauth-docs-2ed49c
branch
from
November 10, 2026 22:10
564f15d to
0f9e71d
Compare
Contributor
|
🌿 Preview your docs: https://vapi-preview-01a1c783-d0bc-73da-b1e2-8761ddcca654.docs.buildwithfern.com |
chris-garber-vapi
force-pushed
the
claude/mcp-server-hosted-first
branch
from
November 11, 2026 18:29
f487fe9 to
67ca955
Compare
Contributor
Author
steven-diaz-vapi
pushed a commit
that referenced
this pull request
Nov 11, 2026
Completes the hosted MCP page after the OAuth rewrite in #1417: lists every tool the server exposes, and adds keyless documentation access. Rebased onto `main`. #1417 replaced the page's connection and sign-in content with tested OAuth instructions, so this PR keeps all of that as is and adds only what #1417 didn't cover. It also absorbs the remaining piece of #1411 (closed as superseded by #1417). ## What changed **Tool list.** The page listed 10 tools and omitted `ask_vapi_docs`. The hosted server pins `@vapi-ai/mcp-server` 0.1.0 (still the latest on npm) and registers all 29 of its tools, plus the hosted-only `get_connection_info`. The table is now grouped by area, using each tool's registered description. Three short notes call out side effects: `create_call` places a real call, each `run_simulations` call starts a billed run, and `load_skill` installs nothing. **Docs-only access.** New "Search the docs without signing in" section for `https://docs.vapi.ai/_mcp/server`, which needs no account. The legacy `@vapi-ai/mcp-docs-server` note now links to it as the like-for-like replacement. **Small fixes.** The organization FAQ points to `get_connection_info`. "Vapi MCP server" is lowercased to match the nav and the rest of the docs. The CLI overview says "coding agent". ## Verification `fern check` is clean, and `fern docs broken-links` reports only the pre-existing `/config-as-code.md` link in `quickstart/introduction.mdx`. In-page anchors checked by hand, since neither command validates them. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the MCP server page for the hosted MCP OAuth migration (PAL-1290). At cutover the hosted server stops accepting Vapi API keys and stops serving
/sse, so every connection instruction on the page changes: users add the URL and sign in instead of pasting a key.Stacked on #1410.
Important
Do not merge before the cutover. The page is written in the present tense and says "Before November 10, 2026…". If the cutover slips, the page describes authentication that doesn't exist yet.
What changed
All six agent tabs. Each previously passed an API key as a bearer token, which now fails. Each now adds the bare URL and signs in through that client's own OAuth path —
codex mcp login,claude mcp login,auth: oauthfor Hermes, a bareurlfor Cursor,type: httpfor VS Code, and a custom connector for Claude Desktop. Taken from each client's own docs rather than assumed to be uniform.New "How signing in works" section. The agent acts as the signed-in user with that user's role, one org per connection,
get_connection_infoto check which identity is live, and the actions Connect tokens can never reach (API keys, credentials, billing).Upgrade note replacing the SSE deprecation note: what to delete from an existing config, and that API keys still work for the Vapi API itself.
Programmatic access reworked around
mcp-remoteand SDK OAuth helpers. The OpenAI example now usesauthorizationwith a sign-in token; its oldheadersfield doesn't exist in that API, so it was broken regardless of OAuth.Open questions
clientId. The tab matches observed behavior, but is worth trying by hand.Verification
fern checkandfern docs broken-linksclean apart from a pre-existing broken link. Tool table checked against what the server actually registers: 29 package tools plusget_connection_info. Anchors verified by hand, since neither check validates them.🤖 Generated with Claude Code