Skip to main content
BoundBot exposes a hosted Model Context Protocol server for external AI clients. Use it when you want a compatible client to work with the current team’s bots, conversations, knowledge, products, leads, orders, channels, and dashboard data. This is the opposite direction from Connected MCPs: Connected MCPs give a BoundBot bot access to an external server, while the BoundBot MCP server gives an external client access to BoundBot.

​
Create an API key

1

Open API Keys

Go to Settings → API Keys in the team you want the client to access.
2

Create a named key

Select Create API Key and use a label that identifies the client or device, such as Support laptop.
3

Copy it immediately

Copy the full sk_... value from the success dialog. BoundBot stores only a hash and shows the full key once.
A key is team-scoped and is not limited to read-only tools. It can send customer messages and create, update, or permanently delete supported records. Store it as a secret, review tool calls in your AI client, and never put it in browser code, a public repository, or a shared screenshot.

​
Configure the MCP client

Use the hosted Streamable HTTP endpoint:
Send the API key as a bearer credential on every request:
A client’s configuration shape varies, but the connection needs these values:
Save the connection and ask the client to list available tools. A successful request updates Last Used for the key in BoundBot.

​
Available tool groups

The server does not currently expose native scheduling, inventory operations, or Point of Sale tools. Normal BoundBot plan limits, ownership boundaries, channel reply windows, and record validation still apply when an MCP tool runs.

​
Rotate or revoke access

The API Keys table shows each key’s name, masked prefix, creation time, and last-used time. BoundBot does not show the secret again. To rotate a credential:
  1. create a replacement key
  2. update the MCP client and verify it connects
  3. revoke the old key from its row menu
Revocation takes effect immediately. Any client still using that key loses access.

​
Troubleshooting

The client receives 401 Unauthorized
  • Confirm the header starts with Bearer followed by the complete key.
  • Copy the replacement key into the client if the original was revoked.
  • Check that a proxy or secret manager is not removing the Authorization header.
The connection succeeds but a write fails
  • Confirm the record belongs to the key’s team.
  • Check required fields and the team’s plan or capacity limit.
  • For customer replies, confirm the destination channel is active and any reply window is still open.
The expected tool is missing
  • Reconnect the client so it refreshes the server’s tool list.
  • Check the table above; scheduling, inventory, and POS are not currently exposed.

Team settings

Manage the team that owns the API key.

Connected MCPs

Let a BoundBot bot call tools on an external MCP server.

Inbox

Review conversations and messages affected by MCP tool calls.

Plans and limits

Check the limits that still apply to MCP-created records.