Webex Go MCP Server

A Go-based Model Context Protocol (MCP) server that exposes Cisco Webex APIs as tools. Supports both STDIO and HTTP transport modes. This allows LLMs (like Claude) to interact with Webex -- sending messages, managing rooms, scheduling meetings, downloading transcripts, and more.

Features

• Two transport modes: STDIO (single-user, access token) and HTTP (OAuth, static token, or hybrid bot/user mode)
• OAuth 2.1 Authorization Server: In HTTP mode, acts as an MCP-compliant OAuth 2.1 authorization server, proxying Webex Integration OAuth (Authorization Code + PKCE)
• Dynamic Client Registration: RFC 7591 support for MCP clients to register dynamically
• Opaque Bearer tokens: Issues its own tokens to MCP clients; Webex tokens never exposed
• Transparent token refresh: Automatically refreshes expired Webex tokens
• Multi-user support: Each authenticated user gets their own Webex API context

MCP tools across Webex API resource categories:

Category	Tools	Operations
Messages	6 (+3 hybrid-only)	List, create, send attachment, send adaptive card, get, delete messages
Rooms	5	List, create, get, update, delete rooms/spaces
Teams	4	List, create, get, update teams
Memberships	4	List, create, update, delete room memberships
Meetings	8	List, create, get, update, patch, delete meetings; list participants, get participant
Transcripts	5	List transcripts, download content, list/get/update snippets
Recordings	3	List, get, download recordings
Streaming	4	Subscribe, unsubscribe, wait_for_message, list_subscriptions
Webhooks	5	List, create, get, update, delete webhooks

Prerequisites

• Go 1.26 or later
• STDIO mode: A Webex access token
• HTTP mode: A Webex Integration for OAuth, a Webex access token for static bot mode, or both for hybrid mode

Build

go build -o webex-go-mcp .

Configuration

Configuration is loaded via environment variables and/or CLI flags. CLI flags take precedence over environment variables.

Common Options

Env Variable	CLI Flag	Required	Default	Description
WEBEX_MODE	--mode	No	stdio	Server mode: stdio or http
WEBEX_API_BASE_URL	--webex-api-base-url	No	https://webexapis.com/v1	Webex API base URL
WEBEX_TIMEOUT	--timeout	No	30s	HTTP request timeout
WEBEX_INCLUDE_TOOLS	--include	No	-	Comma-separated list of tools to include
WEBEX_EXCLUDE_TOOLS	--exclude	No	-	Comma-separated list of tools to exclude
WEBEX_MINIMAL	--minimal	No	false	Enable minimal tool set
WEBEX_READONLY_MINIMAL	--readonly-minimal	No	false	Enable readonly minimal tool set
WEBEX_SHARED_ENV_MINIMAL	--shared-env-minimal	No	false	Enable shared-environment-safe minimal tool set
WEBEX_ENABLE_MCP_ELICITATION	--enable-mcp-elicitation	No	false	Require MCP elicitation approval before mutating Webex tools run. If the client does not support elicitation, protected actions fail closed
WEBEX_STREAMING_IGNORE_FROM_EMAILS	--streaming-ignore-from-emails	No	-	Comma-separated sender emails to drop from Mercury streaming notifications, useful for suppressing messages sent by the bot itself

STDIO Mode Options

Env Variable	CLI Flag	Required	Default	Description
WEBEX_ACCESS_TOKEN	--access-token	Yes (stdio)	-	Webex API bearer token

HTTP Mode Options

Env Variable	CLI Flag	Required	Default	Description
WEBEX_CLIENT_ID	--client-id	Either (http)	-	Webex Integration Client ID. If client ID, secret, and access token are configured, HTTP hybrid mode is used
WEBEX_CLIENT_SECRET	--client-secret	Either (http)	-	Webex Integration Client Secret
WEBEX_ACCESS_TOKEN	--access-token	Either (http)	-	Static server-side Webex token. Without OAuth config, it powers all tools. With client ID and secret, it powers default message sends as the bot in hybrid mode
WEBEX_REDIRECT_URI	--redirect-uri	Yes for OAuth	-	OAuth redirect URI registered with Webex
WEBEX_BASE_URL	--base-url	Yes (http)	-	External base URL of this MCP server, used for OAuth metadata and signed upload URLs. Localhost is supported, e.g. http://localhost:8560 or localhost:8560
WEBEX_AUTH_API_KEY	--auth-api-key	No	-	Optional API key required on /mcp requests via X-API-Key. Applies on top of OAuth or static-token mode
WEBEX_OAUTH_SCOPES	--oauth-scopes	No	spark:all	Webex OAuth scopes (space-separated)
WEBEX_HOST	--host	No	localhost	HTTP server bind host
WEBEX_PORT	--port	No	8080	HTTP server port
WEBEX_TLS_CERT	--tls-cert	No	-	Path to TLS certificate file
WEBEX_TLS_KEY	--tls-key	No	-	Path to TLS key file
WEBEX_CORS_ORIGINS	--cors-origins	No	*	Comma-separated list of allowed CORS origins

Tool Filtering

You can control which tools are exposed using --include or --exclude. Tools are specified in category:action format, where category maps to the Webex API resource (e.g. messages, rooms, meetings) and action is the operation (e.g. list, create, get, delete).

Both singular and plural category forms are accepted (message:list and messages:list both work).

The category:action shorthand maps to the full tool name webex_{category}_{action}. For example, messages:list maps to webex_messages_list.

When WEBEX_ENABLE_MCP_ELICITATION=true, tools that send, create, update, patch, or delete Webex resources request MCP elicitation approval before calling Webex. Read/list/get/search/download tools do not require elicitation. If the connected MCP client does not support elicitation, protected actions are not performed.

Rules:

• If --include is set, only the specified tools are registered.
• If --exclude is set, all tools except the specified ones are registered.
• If both are set, --include takes priority and --exclude is ignored.
• If neither is set, all tools are registered (default).

Available categories and actions:

Category	Actions
people	get
messages	list, create, send_attachment, send_adaptive_card, get, delete; hybrid-only: create_as_logged_in_user, send_attachment_as_logged_in_user, send_adaptive_card_as_logged_in_user
rooms	list, create, get, update, delete
teams	list, create, get, update
memberships	list, create, update, delete
meetings	list, create, get, update, patch, delete, list_participants, get_participant
transcripts	list, download, list_snippets, get_snippet, update_snippet
recordings	list, get, download
streaming	subscribe_room_messages, unsubscribe, wait_for_message, list_subscriptions
webhooks	list, create, get, update, delete

Preset Flags

For convenience, preset flags are available that automatically add a curated set of tools to the --include list:

• --minimal -- All operations for messages, rooms, teams, meetings, transcripts, and streaming (excludes memberships and webhooks). Includes the hybrid-only logged-in-user send tools when HTTP hybrid mode is enabled.
• --shared-env-minimal -- Shared bot-safe surface: person lookup and outbound message/card/attachment tools only. No room/message history reads, broad lists, subscriptions, transcripts, meetings, memberships, webhooks, updates, or deletes. Includes the hybrid-only logged-in-user send tools when HTTP hybrid mode is enabled.
• --readonly-minimal -- Only read/list/get operations for messages, rooms, teams, meetings, transcripts, and streaming. No create, update, or delete. 17 tools.

These flags merge with --include -- they don't override it. For example, --minimal --include "webhooks:list" registers the minimal set plus webhooks:list. If multiple presets are set, --shared-env-minimal takes priority because it is the safest.

Examples:

# Only register read-only transcript tools
./webex-go-mcp --include "transcripts:list,transcripts:download,transcripts:list_snippets,transcripts:get_snippet"

# Register all tools except destructive ones
./webex-go-mcp --exclude "messages:delete,rooms:delete,meetings:delete,memberships:delete,webhooks:delete"

# Use the minimal preset (messages, rooms, teams, meetings, transcripts)
./webex-go-mcp --minimal

# Use readonly-minimal (only read operations, no writes)
./webex-go-mcp --readonly-minimal

# Use shared-env-minimal (safe for shared bot deployments)
./webex-go-mcp --shared-env-minimal

# Minimal preset plus an extra tool
./webex-go-mcp --minimal --include "webhooks:list"

Usage

STDIO Mode (default)

export WEBEX_ACCESS_TOKEN="your-token-here"
./webex-go-mcp

HTTP Mode

OAuth mode:

export WEBEX_CLIENT_ID="your-client-id"
export WEBEX_CLIENT_SECRET="your-client-secret"
export WEBEX_REDIRECT_URI="http://localhost:8080/callback"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

Static token mode:

export WEBEX_ACCESS_TOKEN="your-token-here"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

Hybrid mode:

export WEBEX_CLIENT_ID="your-client-id"
export WEBEX_CLIENT_SECRET="your-client-secret"
export WEBEX_REDIRECT_URI="http://localhost:8080/callback"
export WEBEX_ACCESS_TOKEN="your-bot-token-here"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

In hybrid mode, users still authenticate with OAuth. Read/user-context tools use the logged-in user's token. Default message send tools use WEBEX_ACCESS_TOKEN, so messages are sent as the bot. Hybrid-only *_as_logged_in_user tools send as the OAuth user instead and refuse direct sends to that same logged-in user.

Optional MCP API-key guard:

export WEBEX_AUTH_API_KEY="your-mcp-api-key"

Clients must then send:

X-API-Key: your-mcp-api-key

Setting Up a Webex Integration (HTTP Mode)

1. Go to developer.webex.com and sign in
2. Navigate to My Webex Apps > Create a New App > Integration
3. Fill in the required fields:
   • Redirect URI: Set to http://localhost:8080/callback (or your server's /callback URL)
   • Scopes: Select the scopes your tools need (e.g., spark:all)
4. Note the Client ID and Client Secret
5. Set them as environment variables or CLI flags

HTTP Mode Endpoints

Endpoint	Method	Auth	Description
/.well-known/oauth-protected-resource	GET	No	RFC 9728 Protected Resource Metadata
/.well-known/oauth-authorization-server	GET	No	RFC 8414 Authorization Server Metadata
/register	POST	No	RFC 7591 Dynamic Client Registration
/authorize	GET	No	OAuth authorization (redirects to Webex)
/callback	GET	No	OAuth callback (from Webex)
/token	POST	No	Token exchange (auth code → Bearer token)
/mcp	POST	Bearer	MCP Streamable HTTP endpoint

OAuth Flow (HTTP Mode)

sequenceDiagram
    participant Client as MCP Client
    participant Server as Our Server
    participant Webex as Webex

    Client->>Server: POST /register
    Server-->>Client: client_id

    Client->>Server: GET /authorize
    Server->>Webex: GET /v1/authorize
    Server-->>Client: redirect to Webex

    Note over Client,Webex: User consents in browser

    Webex->>Server: GET /callback (auth code)
    Server->>Webex: POST /v1/access_token
    Webex-->>Server: Webex tokens
    Server-->>Client: redirect with code

    Client->>Server: POST /token (auth code)
    Server-->>Client: opaque Bearer token

    Client->>Server: POST /mcp (Bearer token)
    Note over Server: Resolves Webex token from opaque token
    Server-->>Client: tool results

Run directly from Git (no build required)

If you have Go installed, you can run the server directly from the repository without cloning or building. Go will fetch, compile, and execute in one step:

export WEBEX_ACCESS_TOKEN="your-token-here"
go run github.com/tejzpr/webex-go-mcp@latest

This is especially convenient when configuring MCP clients like Cursor or Claude Desktop -- no pre-built binary needed.

Claude Desktop

Add to your Claude Desktop MCP configuration (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

Using a pre-built binary:

{
  "mcpServers": {
    "webex": {
      "command": "/path/to/webex-go-mcp",
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Using go run directly from Git (no build step):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Cursor

Add to your Cursor MCP configuration (.cursor/mcp.json in your project or ~/.cursor/mcp.json globally):

Using a pre-built binary:

{
  "mcpServers": {
    "webex": {
      "command": "/path/to/webex-go-mcp",
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Using go run directly from Git (no build step):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

With tool filtering (only expose specific tools):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest", "--include", "messages:list,messages:get,transcripts:list,transcripts:download"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

With readonly-minimal preset (safe, read-only access):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest", "--readonly-minimal"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

Note: The go run approach requires Go to be installed and available on your PATH. The first run will download and compile the module (cached for subsequent runs). To update to the latest version, Go will re-fetch when @latest resolves to a newer release.

Tool Reference

Messages

• webex_messages_list -- List messages in a room (requires roomId). Enriched with room context, sender names, and file metadata.
• webex_messages_create -- Send a text message. To DM someone, just pass toPersonEmail -- no room lookup needed. For group spaces, use roomId.
• webex_messages_send_attachment -- Send a message with a file attachment. In HTTP mode, use webex_uploads_request_url + uploadId for local client files.
• webex_messages_send_adaptive_card -- Send an Adaptive Card to a room or person. In HTTP mode, card image URLs can use mcp-upload://<uploadId> after webex_uploads_request_url; do not use Webex attachment files URLs as card images.
• webex_messages_create_as_logged_in_user -- Hybrid mode only. Send text as the logged-in OAuth user instead of the bot.
• webex_messages_send_attachment_as_logged_in_user -- Hybrid mode only. Send an attachment as the logged-in OAuth user instead of the bot.
• webex_messages_send_adaptive_card_as_logged_in_user -- Hybrid mode only. Send an Adaptive Card as the logged-in OAuth user instead of the bot.
• webex_messages_get -- Get a message by ID. Enriched with sender profile, room info, and file content (text files inline).
• webex_messages_delete -- Delete a message by ID

Rooms / Spaces

• webex_rooms_list -- List rooms (filter by teamId, type, sortBy)
• webex_rooms_create -- Create a room (title required, optional teamId)
• webex_rooms_get -- Get room details by ID
• webex_rooms_update -- Update room title
• webex_rooms_delete -- Delete a room

Teams

• webex_teams_list -- List teams
• webex_teams_create -- Create a team (name required)
• webex_teams_get -- Get team details by ID
• webex_teams_update -- Update team name

Memberships

• webex_memberships_list -- List memberships (filter by roomId, personEmail)
• webex_memberships_create -- Add person to room (roomId + personEmail or personId)
• webex_memberships_update -- Update membership (set isModerator)
• webex_memberships_delete -- Remove person from room

Meetings

• webex_meetings_list -- List meetings (filter by meetingType, state, from, to). Note: meetingType is required when state is used.
• webex_meetings_create -- Schedule a meeting with optional invitees (title, start, end required; invitees accepts comma-separated emails)
• webex_meetings_get -- Get meeting details by ID
• webex_meetings_update -- Update a meeting
• webex_meetings_patch -- Partially update a meeting (PATCH semantics)
• webex_meetings_delete -- Cancel/delete a meeting
• webex_meetings_list_participants -- List who actually attended a past meeting (join/leave times, host status, devices)
• webex_meetings_get_participant -- Get a specific participant by ID

Transcripts

• webex_transcripts_list -- List meeting transcripts (filter by meetingId, hostEmail, date range)
• webex_transcripts_download -- Download transcript content (requires transcriptId + meetingId, optional format: txt or vtt)
• webex_transcripts_list_snippets -- List spoken segments from a transcript
• webex_transcripts_get_snippet -- Get a specific transcript snippet
• webex_transcripts_update_snippet -- Update/correct a transcript snippet's text

Recordings

• webex_recordings_list -- List meeting recordings (filter by meetingId, hostEmail, date range)
• webex_recordings_get -- Get recording details by ID
• webex_recordings_download -- Download recording content

Streaming

• webex_subscribe_room_messages -- Subscribe to real-time messages in a room
• webex_unsubscribe -- Unsubscribe from a subscription
• webex_wait_for_message -- Wait for the next message on a subscription
• webex_list_subscriptions -- List active subscriptions

Webhooks

• webex_webhooks_list -- List webhooks
• webex_webhooks_create -- Create a webhook (name, targetUrl, resource, event required)
• webex_webhooks_get -- Get webhook details by ID
• webex_webhooks_update -- Update a webhook
• webex_webhooks_delete -- Delete a webhook

Architecture

webex-go-mcp/
  main.go       -- Cobra CLI + Viper config, mode branching (STDIO/HTTP)
  server.go     -- MCP server setup, STDIO + HTTP server startup
  auth/
    client_resolver.go  -- ClientResolver type (static for STDIO, context-based for HTTP)
    discovery.go        -- RFC 9728 + RFC 8414 well-known metadata endpoints
    middleware.go       -- Bearer token auth middleware, transparent token refresh
    oauth.go            -- /authorize, /callback, /token (proxies Webex OAuth)
    registration.go     -- RFC 7591 Dynamic Client Registration
    store.go            -- In-memory token store, auth code store, pending auth state
  tools/
    filter.go         -- ToolRegistrar interface, tool include/exclude filtering
    enrich.go         -- Response enrichment helpers (person names, room info, files)
    messages.go       -- 6 message tools
    rooms.go          -- 5 room tools
    recordings.go     -- 3 recording tools
    teams.go          -- 4 team tools
    memberships.go    -- 4 membership tools
    meetings.go       -- 8 meeting tools
    transcripts.go    -- 5 transcript tools
    webhooks.go       -- 5 webhook tools
  streaming/
    manager.go        -- Real-time subscriptions (subscribe, unsubscribe, wait_for_message, list_subscriptions)

Dependencies

• mcp-go -- MCP server framework (STDIO + Streamable HTTP)
• webex-go-sdk -- Webex API client
• cobra -- CLI framework
• viper -- Configuration management

License

MPL-2.0