What is MCP server development, and what do we build?
MCP server development means building a small, secure service that lets AI apps such as Claude, ChatGPT and Cursor read from and act on your own systems through the Model Context Protocol, with sign-in, permissions and logging built in.
What an MCP server can offer an AI app
The Model Context Protocol (MCP) is an open standard. An AI app (the host) runs an MCP client, and the client talks to an MCP server over JSON-RPC messages. The server decides what the AI is allowed to see and do. Under the current specification, version 2026-07-28, a server can offer three things: tools (functions the model can call, such as "create a contact"), resources (data the user or model can read, such as a price list) and prompts (templated instructions a user can pick).
For a business, that means your team can ask an AI app "which leads from last week have not had a reply?" and get an answer from your real CRM, or tell it "book Maria for Thursday at 3" and have the booking land in your calendar, with the AI limited to the actions you approved.
We have delivered API and MCP integrations for client businesses, each one shaped around how that business works. What we build at Autoesta:
- Custom MCP servers over your CRM (often GoHighLevel), your database, or an internal API, with a short list of task-shaped tools.
- Sign-in and permissions: OAuth for remote servers, scoped so each person and each AI app only gets what it needs.
- Hosting and logging on your own cloud account, with every tool call recorded.
- n8n-backed servers, where each MCP tool runs an n8n workflow you can see and edit. See our n8n automation service for how we build and host those workflows.
An MCP server is usually one part of a larger agent build. If you want the agent itself designed (the prompts, the model, the hand-off to staff), start with our AI agent development page; this page covers the connection layer underneath.
An MCP server is often the piece that decides whether an agent project survives contact with real systems; our AI agent adoption research traces why so many agent projects stall before production.
How does an MCP server work?
The AI app sends each request to the MCP server, the server checks the caller's token and permissions, runs the matching tool against your system with its own credentials, and returns a result the model can read and act on.
One tool call over Streamable HTTP
Two ways to connect: stdio and Streamable HTTP
The specification defines two standard transports. stdio runs the server as a local program that the AI app starts on the same computer, which suits a developer's laptop. Streamable HTTP puts the server at one web address (for example https://mcp.example.com/mcp); each message is an HTTP POST, and the reply is either one JSON object or a short stream of events for that request. Business servers that a whole team, or a cloud AI app, needs to reach are almost always Streamable HTTP.
What changed in the 2026-07-28 version
The 2026-07-28 revision removed protocol-level sessions and the separate GET stream from Streamable HTTP. Each request now carries its own protocol version and client details, and servers that need memory between calls return an explicit handle (a cart ID, a job ID) that the model passes back. Older clients still use the 2025 session style, so a server that must work with both has to implement the backward-compatibility rules in the spec. We check which version each of your AI apps speaks before we build.
Every Streamable HTTP request also carries headers such as MCP-Protocol-Version, Mcp-Method and Mcp-Name, so gateways and firewalls can route and log calls without reading the body. The server must reject a request whose headers and body disagree.
Which AI apps can connect to a custom MCP server?
Claude, ChatGPT, the Claude and OpenAI APIs, Cursor and n8n can all connect to a remote MCP server over HTTP. They differ in where you add the server, which sign-in methods they accept, and whether a local stdio server works.
We built this matrix from each vendor's own documentation, read on October 30, 2026. Vendors change these screens often, so treat menu paths as a snapshot.
| Client | Remote transport | Local stdio server | Sign-in it accepts | Where you add the server |
|---|---|---|---|---|
| Claude (claude.ai, Desktop) custom connectors | Remote MCP over the public internet, called from Anthropic's cloud | Desktop only, via its config file; not in claude.ai | OAuth ("Sign in now" or "when needed"), no sign-in, or a fixed key in request headers | Customize, Connectors (Pro, Max, members); Organization settings, Connectors (Team and Enterprise owners). Free plan: one custom connector |
| Claude API (MCP connector, beta) | Streamable HTTP or SSE | No | You run OAuth yourself and pass authorization_token | mcp_servers plus an mcp_toolset on each request. Tools only; resources and prompts are not supported |
| OpenAI Responses API | Streamable HTTP or HTTP/SSE | No | OAuth access token in the authorization field, sent on every request | The mcp tool in the request; require_approval and allowed_tools control it |
| ChatGPT | Streamable HTTP on a public HTTPS URL, usually ending /mcp | Only through OpenAI's Secure MCP Tunnel | Configured during setup; authentication discovery must work | ChatGPT Plugins, then "Add custom MCP server"; account and workspace policies apply |
| Cursor | SSE or Streamable HTTP | Yes | OAuth with PKCE and dynamic registration, or a fixed client ID and secret | .cursor/mcp.json in the project or ~/.cursor/mcp.json globally |
| n8n MCP Client Tool (n8n agent calling your server) | SSE endpoint | No | Bearer, header, multiple headers, OAuth2, or none | Node settings; expose all tools, selected tools, or all except some |
Two practical points come out of this table. First, Claude's cloud connectors and ChatGPT both call your server from the vendor's infrastructure, so a server that only lives on your office network will not be reachable without an allowlist or a tunnel. Second, the API routes (Claude API and OpenAI Responses) leave the OAuth flow to you, which is fine for a back-office agent and awkward for a tool your staff click on.
Does GoHighLevel have an official MCP server?
Yes. HighLevel publishes an official MCP server with OAuth sign-in and four tools that search, describe and run more than 550 operations across 38 areas of a sub-account. It connects to Claude, ChatGPT, Codex, Cursor and Muse.
HighLevel's help article (last modified October 29, 2026) and its Marketplace developer docs describe it this way:
| Item | What HighLevel's docs say |
|---|---|
| Endpoints | Separate URLs per client: /mcp/anthropic/v2 (Claude), /mcp/openai/v2/ (ChatGPT and OpenAI clients), /mcp/cursor/v2 (Cursor), /mcp/muse/v2/ (Muse), all on services.leadconnectorhq.com |
| Sign-in | OAuth through a LeadConnector sign-in, sub-account choice and scope approval; no token to create or rotate by hand |
| Tools | Four: list_locations, search_operations, describe_operation, execute_operation |
| Coverage | More than 550 read, create, update and delete operations across 38 domains, limited by the scopes you approve |
| Limits | One sub-account per connection and per request; agency-wide (multi-sub-account) connections are still rolling out; sensitive and irreversible operations need extra confirmation |
So for many GoHighLevel users the honest first step is to connect HighLevel's own server and see whether it covers the job. We build a custom server around GoHighLevel when you need something it does not do: combining CRM data with another system in one tool (bookings plus your job-management app, for example), enforcing your own business rules before a write, working across several sub-accounts in one answer, or giving staff a short list of safe actions instead of 550 raw ones. For the underlying API work, see our GoHighLevel API integration service and our guide to HighLevel private integration tokens and OAuth. For a related announcement, read how Meta's Muse agent added HighLevel as a connector.
Can n8n act as an MCP server?
Yes. n8n's MCP Server Trigger node turns a workflow into an MCP server whose tools are other n8n nodes or whole workflows, reachable over SSE or Streamable HTTP with bearer or header authentication. It does not support stdio.
This is often the fastest route for a business that already runs n8n. Each tool can be a full workflow with its own error handling, so the AI app calls "create quote" and n8n does the ten steps behind it. n8n's documentation lists the details that trip people up:
- The test URL only works while you are listening in the editor; the production URL is registered when you publish the workflow.
- In queue mode with several webhook replicas, all
/mcp*traffic must go to one replica or connections break. - Behind a reverse proxy such as nginx, proxy buffering (and gzip and chunked encoding) must be turned off for the MCP endpoint.
- claude.ai custom connectors may ask users to sign in even when the trigger's authentication is set to None.
n8n works the other way round too: the MCP Client Tool node lets an n8n AI agent call tools on someone else's MCP server. If your n8n agent ignores its tools, our note on why an n8n AI agent does not call its tools covers the usual causes.
How much does MCP server development cost?
The protocol is free. You pay for the build, hosting on your own cloud account and any AI app plans. We quote MCP servers at a fixed price after a free strategy call, and fix what we build free for 6 months.
Our prices, at the time of writing:
- Strategy call and audit: free. We look at the systems involved and the actions you want the AI to take, and you leave with a written plan.
- A small automation build of two or three workflows is about $1,000. An MCP server is scoped separately because the number of tools, the sign-in method and the systems behind it change the work a lot, so we quote it as a fixed price after the free call.
- Fixes to anything we built are free for 6 months. After that, monthly support from $200 is optional.
Costs outside our fee are yours and depend on choices you make: the cloud host that runs the server, the plan of the AI app your team uses (Claude's Free plan, for example, allows one custom connector), and your CRM or database plan. If you use HighLevel's own MCP server instead of a custom one, the help article we read does not mention a separate fee for it. For how we price automation work in general, see how much an automation project costs.
How does an MCP server build work with Autoesta?
We agree the exact actions the AI may take, design a short list of tools around them, build and secure the server on your accounts, test it in each AI app your team uses, then hand over the keys, logs and documentation.
- Free call. We list the questions people will ask and the actions they want done, and we check whether an official server (such as HighLevel's) or a plain integration already covers it.
- Tool design. We write each tool as a business task ("find open invoices for a client"), with a tight input schema, a clear description, and a note of whether it reads or writes.
- Permissions. We map each tool to the smallest scope it needs and decide which writes need a human to approve them.
- Build. Code on the official MCP SDKs, or an n8n MCP Server Trigger when your logic already lives in n8n. Secrets go in your secret store, never in the tool definitions.
- Hosting. On your cloud account, behind HTTPS, with Origin checks, rate limits and a log of every call.
- Client testing. We connect the server to each AI app in the matrix above that you use, and test the sign-in flow, every tool, and the failure cases.
- Handover. You get the repository, the credentials, a tool list in plain language, and a runbook. Our 6 months of free fixes start here.
When do you not need an MCP server?
You do not need one when no person will ask an AI app to act. A fixed process between two systems is a plain API integration or an n8n workflow, and a single AI agent you own can call your API directly as a tool.
MCP server or something simpler?
MCP earns its cost when the same set of actions has to work inside several AI apps, or when staff will ask open-ended questions that need live data. It adds a moving part when the job is a fixed, repeatable flow. Use this as a rough guide:
| Your situation | Usually the better fit |
|---|---|
| New form lead goes to the CRM, then a text and an email | A workflow in your CRM or an n8n workflow; no AI app involved |
| Two systems must stay in sync on a schedule | An API integration with retries and logs |
| One voice or chat agent that books appointments | Tools defined inside that agent, calling your API; see our AI agents page |
| Staff want to ask Claude or ChatGPT about live CRM data, and act on it | An MCP server (official, if one covers it; custom if not) |
| Several AI apps or agents need the same safe set of actions | One MCP server they all share |
| You need a full internal tool with screens, roles and reports | Custom software, possibly with an MCP server on top later |
How do you secure an MCP server?
Use OAuth for remote servers, accept only tokens issued for your server, grant the smallest scopes, validate every tool input, require a human to approve sensitive writes, log every call, and treat tool output as untrusted because of prompt injection.
The MCP specification states plainly that tools amount to arbitrary code execution and that "Hosts must obtain explicit user consent before invoking any tool." Most of the controls below come straight from the spec and its security best practices page:
- OAuth 2.1 for HTTP servers. The authorization spec is based on OAuth 2.1. The server must publish Protected Resource Metadata (RFC 9728), and clients must send a
resourceparameter (RFC 8707) so tokens are bound to your server. Local stdio servers should take credentials from the environment instead. - No token passthrough. The server must only accept tokens issued for it, and must not forward a client's token to your CRM. It uses its own credential for the downstream API.
- Least privilege. Start with read-only scopes and ask for more with a scope challenge when a write is first attempted. The spec lists publishing every scope up front and wildcard scopes as common mistakes.
- Server duties. Validate all tool inputs, enforce access controls, rate-limit tool calls and sanitize outputs. These four are MUST requirements in the tools section.
- Origin checks. Streamable HTTP servers must validate the
Originheader to block DNS rebinding, and local servers should bind to 127.0.0.1 only. - Human approval for writes. The spec says there should always be a human able to deny a tool call. OpenAI's API asks for approval by default, Cursor asks before running a tool, and Anthropic warns that Claude's research mode can call connector tools without asking, so write tools should be disabled there.
- Prompt injection. Anthropic and OpenAI both warn that a malicious or compromised server, or user-supplied content passing through one, can carry instructions that steer the model or leak data. Connect only servers you trust, and keep sensitive data out of tools that also read outside content.
If your data includes patient information, also read our guide to HIPAA-compliant automation with GoHighLevel and n8n before any AI app touches it.
Why do MCP servers fail, and how do you fix them?
Most failures come from five places: tools filtered out by scopes or schema errors, sign-in loops from bad OAuth metadata, proxies that buffer streams, servers the AI app cannot reach, and too many tools for the model to choose well.
We built this table from the MCP specification, the client docs in the matrix above, and n8n's MCP Server Trigger notes. It is the checklist we run before handover.
| Symptom | Likely cause | Fix |
|---|---|---|
| Server connects but shows no tools, or fewer than expected | The tool list can vary by the caller's granted scopes; a client must drop any tool whose x-mcp-header annotation is invalid; in n8n, the workflow is not published so only the test URL exists | Check the token's scopes, validate tool schemas, publish the n8n workflow and use the production URL |
| Endless sign-in prompts or repeated 401 errors | Missing Protected Resource Metadata, a token issued for a different audience, or a server that asks for missing scopes one at a time | Publish the metadata document, check the token audience, and return every scope an operation needs in one WWW-Authenticate challenge |
| claude.ai asks users to sign in to a server with no auth | n8n reports claude.ai is the one client known to do this | Add proper authentication to the server |
| 400 errors such as HeaderMismatch or unsupported protocol version | Client and server speak different protocol revisions, or a proxy rewrote headers | Support the versions your clients use and follow the spec's backward-compatibility rules |
| Calls hang, time out, or results arrive all at once | A reverse proxy buffers the SSE stream; several n8n webhook replicas split the traffic; a slow tool exceeds the client's timeout | Send X-Accel-Buffering: no and disable buffering for the endpoint, route /mcp* to one replica, and make long jobs return a handle the model can check later |
| Works locally, fails from Claude or ChatGPT | The server is on a private network; Claude's connectors call from Anthropic's IP ranges | Expose it over public HTTPS with an allowlist, or use OpenAI's Secure MCP Tunnel for ChatGPT |
| The model picks the wrong tool or ignores tools | Too many tools or vague descriptions; Anthropic's docs say tool choice degrades past 30 to 50 tools | Fewer, task-shaped tools; limit tools with allowed_tools or toolset configs; use tool search with deferred loading for large catalogs |
| A write happened that nobody reviewed | Approval turned off, or a mode that runs tools without asking | Require approval for writes, disable write tools in research modes, log every call with the user's identity |
Who owns the MCP server, the keys and the data?
You do. We build the server in your code repository, host it on your cloud account, and register the OAuth app and API keys in your name, so you can change agencies or switch it off without asking us.
Your CRM, database and AI app accounts stay yours as well; the server only holds the access you grant it, and you can revoke that access in each system at any time. We document every tool, scope and secret location at handover. Our general policy is set out in who owns the automations and data we build.
Read next:
- MCP server vs API, explained
- step-by-step HighLevel MCP setup for Claude and ChatGPT
- the security risks of MCP servers
- does Autoesta build MCP servers and API integrations
More questions about MCP server development
What is the difference between an MCP server and an API?
An API is how software talks to your system, and it is built for programmers who know exactly which call to make. An MCP server sits on top of one or more APIs and describes a set of tools in a standard way that AI apps understand, so a model can find the right action, ask for permission and call it. Most MCP servers use your existing API underneath.
Can I connect a custom MCP server to ChatGPT?
Yes. OpenAI's docs describe adding it from ChatGPT Plugins with "Add custom MCP server". The server must answer on a public HTTPS address, usually ending in /mcp, over Streamable HTTP, or be reached through OpenAI's Secure MCP Tunnel. Authentication is set during setup, and your account or workspace policies decide whether custom servers are allowed.
Can I connect a custom MCP server to Claude?
Yes. In Claude you add it as a custom connector under Customize, Connectors, or an owner adds it for a Team or Enterprise organization. Anthropic's servers make the calls, so the server must be reachable from the public internet. Developers can also attach remote servers to the Claude API with the MCP connector, which supports tools only.
Should an MCP server use stdio or Streamable HTTP?
Use stdio when one person runs the server on their own computer, such as a developer tool inside Cursor. Use Streamable HTTP when a team or a cloud AI app needs it, because it lives at one web address and supports OAuth. Claude's API, OpenAI's API, ChatGPT and n8n's server trigger do not accept a local stdio server directly.
How many tools should an MCP server have?
As few as the job needs. Anthropic's tool search documentation says Claude's ability to pick the right tool degrades once you exceed 30 to 50 available tools. We design tools around business tasks rather than API endpoints, and for large systems we use a search, describe and run pattern, the approach HighLevel's own server uses with four tools.
Is it safe to let an AI app write to my CRM?
It can be, with limits. Give the AI read-only access first, then add specific write tools with narrow scopes, input checks and a human approval step for anything that sends messages, spends money or deletes data. Log every call with the user who made it. Never connect servers you do not trust, because tool output can carry prompt injection.
How long does an MCP server build take?
It depends on the number of tools, the sign-in method and how clean the API behind it is. A few read-only tools over one well-documented API are a short project; a server that writes to several systems with OAuth and approvals takes longer. We give you a timeline with the fixed quote after the free call. See how long an automation build takes.
Can one MCP server cover several systems?
Yes. A single server can expose tools that read your CRM, check your calendar and write to your database, and one tool can combine them, such as "find the client and their next booking". Keep each tool's permissions separate, and prefix tool names by system, because the spec warns that clients connected to several servers may see name collisions.
Do I need a developer on staff to run an MCP server?
No. Once it is built, a hosted MCP server runs like any small web service. Someone needs to watch the logs, rotate credentials and update it when the protocol or an AI app changes. We fix anything we built free for 6 months, and optional monthly support from $200 covers it after that, at the time of writing.
What does the free strategy call cover?
We look at the systems you want connected, the AI apps your team uses and the actions you want done. We tell you whether an official server, a plain integration, an n8n workflow or a custom MCP server is the right fit, and you get a written plan and a fixed price. You can book the free call here.
Sources and further reading
- Model Context Protocol, Specification, version 2026-07-28 (overview, primitives, security principles), checked October 30, 2026.
- Model Context Protocol, Streamable HTTP transport (Origin checks, headers, removed sessions, backward compatibility), checked October 30, 2026.
- Model Context Protocol, Authorization (OAuth 2.1, RFC 9728, RFC 8707, scope challenges), checked October 30, 2026.
- Model Context Protocol, Tools (human in the loop, server MUSTs, name collisions), checked October 30, 2026.
- Model Context Protocol, Security best practices (token passthrough, confused deputy, scope minimization), checked October 30, 2026.
- Anthropic, Getting started with custom connectors using remote MCP, checked October 30, 2026.
- Anthropic, MCP connector (Claude API) and Tool search tool, checked October 30, 2026.
- OpenAI, MCP and connectors in the Responses API and Connect your MCP server to ChatGPT, checked October 30, 2026.
- Cursor, Model Context Protocol docs, checked October 30, 2026.
- n8n, MCP Server Trigger node and MCP Client Tool node, checked October 30, 2026.
- HighLevel, How to set up and use the HighLevel MCP Server (modified October 29, 2026) and HighLevel MCP Server developer docs, checked October 30, 2026.
