Webex Go MCP Server

A Go-based Model Context Protocol (MCP) server that exposes Cisco Webex APIs as tools. Supports both STDIO and HTTP transport modes. This allows LLMs (like Claude) to interact with Webex -- sending messages, managing rooms, scheduling meetings, downloading transcripts, and more.

Features

Two transport modes: STDIO (single-user, access token) and HTTP (OAuth, static token, or hybrid bot/user mode)
OAuth 2.1 Authorization Server: In HTTP mode, acts as an MCP-compliant OAuth 2.1 authorization server, proxying Webex Integration OAuth (Authorization Code + PKCE)
Dynamic Client Registration: RFC 7591 support for MCP clients to register dynamically
Opaque Bearer tokens: Issues its own tokens to MCP clients; Webex tokens never exposed
Transparent token refresh: Automatically refreshes expired Webex tokens
Multi-user support: Each authenticated user gets their own Webex API context

MCP tools across Webex API resource categories:

Category	Tools	Operations
Messages	6 (+3 hybrid-only)	List, create, send attachment, send adaptive card, get, delete messages
Rooms	5	List, create, get, update, delete rooms/spaces
Teams	4	List, create, get, update teams
Memberships	4	List, create, update, delete room memberships
Meetings	8	List, create, get, update, patch, delete meetings; list participants, get participant
Transcripts	5	List transcripts, download content, list/get/update snippets
Recordings	3	List, get, download recordings
Streaming	8	Subscribe (room, mentions, direct, from-person), unsubscribe, wait_for_message, wait_for_message_in_room_from_person, list_subscriptions
Webhooks	5	List, create, get, update, delete webhooks

Prerequisites

Go 1.26 or later
STDIO mode: A Webex access token
HTTP mode: A Webex Integration for OAuth, a Webex access token for static bot mode, or both for hybrid mode

Build

go build -o webex-go-mcp .

Configuration

Configuration is loaded via environment variables and/or CLI flags. CLI flags take precedence over environment variables.

Common Options

Env Variable	CLI Flag	Required	Default	Description
`WEBEX_MODE`	`--mode`	No	`stdio`	Server mode: `stdio` or `http`
`WEBEX_API_BASE_URL`	`--webex-api-base-url`	No	`https://webexapis.com/v1`	Webex API base URL
`WEBEX_TIMEOUT`	`--timeout`	No	`30s`	HTTP request timeout
`WEBEX_INCLUDE_TOOLS`	`--include`	No	-	Comma-separated list of tools to include
`WEBEX_EXCLUDE_TOOLS`	`--exclude`	No	-	Comma-separated list of tools to exclude
`WEBEX_MINIMAL`	`--minimal`	No	`false`	Enable minimal tool set
`WEBEX_READONLY_MINIMAL`	`--readonly-minimal`	No	`false`	Enable readonly minimal tool set
`WEBEX_SHARED_ENV_MINIMAL`	`--shared-env-minimal`	No	`false`	Enable shared-environment-safe minimal tool set
`WEBEX_ENABLE_MCP_ELICITATION`	`--enable-mcp-elicitation`	No	`false`	Require MCP elicitation approval before mutating Webex tools run. If the client does not support elicitation, protected actions fail closed
`WEBEX_STREAMING_IGNORE_FROM_EMAILS`	`--streaming-ignore-from-emails`	No	-	Comma-separated sender emails to drop from Mercury streaming notifications, useful for suppressing messages sent by the bot itself

STDIO Mode Options

Env Variable	CLI Flag	Required	Default	Description
`WEBEX_ACCESS_TOKEN`	`--access-token`	Yes (stdio)	-	Webex API bearer token

HTTP Mode Options

Env Variable	CLI Flag	Required	Default	Description
`WEBEX_CLIENT_ID`	`--client-id`	Either (http)	-	Webex Integration Client ID. If client ID, secret, and access token are configured, HTTP hybrid mode is used
`WEBEX_CLIENT_SECRET`	`--client-secret`	Either (http)	-	Webex Integration Client Secret
`WEBEX_ACCESS_TOKEN`	`--access-token`	Either (http)	-	Static server-side Webex token. Without OAuth config, it powers all tools. With client ID and secret, it powers default message sends as the bot in hybrid mode
`WEBEX_REDIRECT_URI`	`--redirect-uri`	Yes for OAuth	-	OAuth redirect URI registered with Webex
`WEBEX_BASE_URL`	`--base-url`	Yes (http)	-	External base URL of this MCP server, used for OAuth metadata and signed upload URLs. Localhost is supported, e.g. `http://localhost:8560` or `localhost:8560`
`WEBEX_AUTH_API_KEY`	`--auth-api-key`	No	-	Optional API key required on `/mcp` requests via `X-API-Key`. Applies on top of OAuth or static-token mode
`WEBEX_OAUTH_SCOPES`	`--oauth-scopes`	No	`spark:all`	Webex OAuth scopes (space-separated)
`WEBEX_HOST`	`--host`	No	`localhost`	HTTP server bind host
`WEBEX_PORT`	`--port`	No	`8080`	HTTP server port
`WEBEX_TLS_CERT`	`--tls-cert`	No	-	Path to TLS certificate file
`WEBEX_TLS_KEY`	`--tls-key`	No	-	Path to TLS key file
`WEBEX_CORS_ORIGINS`	`--cors-origins`	No	`*`	Comma-separated list of allowed CORS origins

Tool Filtering

You can control which tools are exposed using --include or --exclude. Tools are specified in category:action format, where category maps to the Webex API resource (e.g. messages, rooms, meetings) and action is the operation (e.g. list, create, get, delete).

Both singular and plural category forms are accepted (message:list and messages:list both work).

The category:action shorthand maps to the full tool name webex_{category}_{action}. For example, messages:list maps to webex_messages_list.

When WEBEX_ENABLE_MCP_ELICITATION=true, tools that send, create, update, patch, or delete Webex resources request MCP elicitation approval before calling Webex. Read/list/get/search/download tools do not require elicitation. If the connected MCP client does not support elicitation, protected actions are not performed.

Rules:

If --include is set, only the specified tools are registered.
If --exclude is set, all tools except the specified ones are registered.
If both are set, --include takes priority and --exclude is ignored.
If neither is set, all tools are registered (default).

Available categories and actions:

Category	Actions
`people`	`get`
`messages`	`list`, `create`, `send_attachment`, `send_adaptive_card`, `get`, `delete`; hybrid-only: `create_as_logged_in_user`, `send_attachment_as_logged_in_user`, `send_adaptive_card_as_logged_in_user`
`rooms`	`list`, `create`, `get`, `update`, `delete`
`teams`	`list`, `create`, `get`, `update`
`memberships`	`list`, `create`, `update`, `delete`
`meetings`	`list`, `create`, `get`, `update`, `patch`, `delete`, `list_participants`, `get_participant`
`transcripts`	`list`, `download`, `list_snippets`, `get_snippet`, `update_snippet`
`recordings`	`list`, `get`, `download`
`streaming`	`subscribe_room_messages`, `subscribe_mentions`, `subscribe_direct_messages`, `subscribe_messages_from_person`, `unsubscribe`, `wait_for_message`, `wait_for_message_in_room_from_person`, `list_subscriptions`
`webhooks`	`list`, `create`, `get`, `update`, `delete`

Preset Flags

For convenience, preset flags are available that automatically add a curated set of tools to the --include list:

--minimal -- All operations for messages, rooms, teams, meetings, transcripts, and streaming (excludes memberships and webhooks). Includes the hybrid-only logged-in-user send tools when HTTP hybrid mode is enabled.
--shared-env-minimal -- Shared bot-safe surface: person lookup and outbound message/card/attachment tools only. No room/message history reads, broad lists, subscriptions, transcripts, meetings, memberships, webhooks, updates, or deletes. Includes the hybrid-only logged-in-user send tools when HTTP hybrid mode is enabled.
--readonly-minimal -- Only read/list/get operations for messages, rooms, teams, meetings, transcripts, and streaming. No create, update, or delete. 17 tools.

These flags merge with --include -- they don't override it. For example, --minimal --include "webhooks:list" registers the minimal set plus webhooks:list. If multiple presets are set, --shared-env-minimal takes priority because it is the safest.

Examples:

# Only register read-only transcript tools
./webex-go-mcp --include "transcripts:list,transcripts:download,transcripts:list_snippets,transcripts:get_snippet"

# Register all tools except destructive ones
./webex-go-mcp --exclude "messages:delete,rooms:delete,meetings:delete,memberships:delete,webhooks:delete"

# Use the minimal preset (messages, rooms, teams, meetings, transcripts)
./webex-go-mcp --minimal

# Use readonly-minimal (only read operations, no writes)
./webex-go-mcp --readonly-minimal

# Use shared-env-minimal (safe for shared bot deployments)
./webex-go-mcp --shared-env-minimal

# Minimal preset plus an extra tool
./webex-go-mcp --minimal --include "webhooks:list"

Usage

STDIO Mode (default)

export WEBEX_ACCESS_TOKEN="your-token-here"
./webex-go-mcp

HTTP Mode

OAuth mode:

export WEBEX_CLIENT_ID="your-client-id"
export WEBEX_CLIENT_SECRET="your-client-secret"
export WEBEX_REDIRECT_URI="http://localhost:8080/callback"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

Static token mode:

export WEBEX_ACCESS_TOKEN="your-token-here"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

Hybrid mode:

export WEBEX_CLIENT_ID="your-client-id"
export WEBEX_CLIENT_SECRET="your-client-secret"
export WEBEX_REDIRECT_URI="http://localhost:8080/callback"
export WEBEX_ACCESS_TOKEN="your-bot-token-here"
./webex-go-mcp --mode http --port 8080 --base-url http://localhost:8080

In hybrid mode, users still authenticate with OAuth. Read/user-context tools use the logged-in user's token. Default message send tools use WEBEX_ACCESS_TOKEN, so messages are sent as the bot. Hybrid-only *_as_logged_in_user tools send as the OAuth user instead and refuse direct sends to that same logged-in user.

Optional MCP API-key guard:

export WEBEX_AUTH_API_KEY="your-mcp-api-key"

Clients must then send:

X-API-Key: your-mcp-api-key

Setting Up a Webex Integration (HTTP Mode)

Go to developer.webex.com and sign in
Navigate to My Webex Apps > Create a New App > Integration
Fill in the required fields:
- Redirect URI: Set to http://localhost:8080/callback (or your server's /callback URL)
- Scopes: Select the scopes your tools need (e.g., spark:all)
Note the Client ID and Client Secret
Set them as environment variables or CLI flags

HTTP Mode Endpoints

Endpoint	Method	Auth	Description
`/.well-known/oauth-protected-resource`	GET	No	RFC 9728 Protected Resource Metadata
`/.well-known/oauth-authorization-server`	GET	No	RFC 8414 Authorization Server Metadata
`/register`	POST	No	RFC 7591 Dynamic Client Registration
`/authorize`	GET	No	OAuth authorization (redirects to Webex)
`/callback`	GET	No	OAuth callback (from Webex)
`/token`	POST	No	Token exchange (auth code → Bearer token)
`/mcp`	POST	Bearer	MCP Streamable HTTP endpoint

OAuth Flow (HTTP Mode)

sequenceDiagram
    participant Client as MCP Client
    participant Server as Our Server
    participant Webex as Webex

    Client->>Server: POST /register
    Server-->>Client: client_id

    Client->>Server: GET /authorize
    Server->>Webex: GET /v1/authorize
    Server-->>Client: redirect to Webex

    Note over Client,Webex: User consents in browser

    Webex->>Server: GET /callback (auth code)
    Server->>Webex: POST /v1/access_token
    Webex-->>Server: Webex tokens
    Server-->>Client: redirect with code

    Client->>Server: POST /token (auth code)
    Server-->>Client: opaque Bearer token

    Client->>Server: POST /mcp (Bearer token)
    Note over Server: Resolves Webex token from opaque token
    Server-->>Client: tool results

Run directly from Git (no build required)

If you have Go installed, you can run the server directly from the repository without cloning or building. Go will fetch, compile, and execute in one step:

export WEBEX_ACCESS_TOKEN="your-token-here"
go run github.com/tejzpr/webex-go-mcp@latest

This is especially convenient when configuring MCP clients like Cursor or Claude Desktop -- no pre-built binary needed.

Claude Desktop

Add to your Claude Desktop MCP configuration (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

Using a pre-built binary:

{
  "mcpServers": {
    "webex": {
      "command": "/path/to/webex-go-mcp",
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Using go run directly from Git (no build step):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Cursor

Add to your Cursor MCP configuration (.cursor/mcp.json in your project or ~/.cursor/mcp.json globally):

Using a pre-built binary:

{
  "mcpServers": {
    "webex": {
      "command": "/path/to/webex-go-mcp",
      "env": {
        "WEBEX_ACCESS_TOKEN": "your-token-here"
      }
    }
  }
}

Using go run directly from Git (no build step):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

With tool filtering (only expose specific tools):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest", "--include", "messages:list,messages:get,transcripts:list,transcripts:download"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

With readonly-minimal preset (safe, read-only access):

{
  "mcpServers": {
    "webex": {
      "command": "go",
      "args": ["run", "github.com/tejzpr/webex-go-mcp@latest", "--readonly-minimal"],
      "env": {
        "WEBEX_ACCESS_TOKEN": "<WEBEX_ACCESS_TOKEN>"
      }
    }
  }
}

Note: The go run approach requires Go to be installed and available on your PATH. The first run will download and compile the module (cached for subsequent runs). To update to the latest version, Go will re-fetch when @latest resolves to a newer release.

Tool Reference

Messages

webex_messages_list -- List messages in a room (requires roomId). Enriched with room context, sender names, and file metadata.
webex_messages_create -- Send a text message. To DM someone, just pass toPersonEmail -- no room lookup needed. For group spaces, use roomId.
webex_messages_send_attachment -- Send a message with a file attachment. In HTTP mode, use webex_uploads_request_url + uploadId for local client files.
webex_messages_send_adaptive_card -- Send an Adaptive Card to a room or person. In HTTP mode, card image URLs can use mcp-upload://<uploadId> after webex_uploads_request_url; do not use Webex attachment files URLs as card images.
webex_messages_create_as_logged_in_user -- Hybrid mode only. Send text as the logged-in OAuth user instead of the bot.
webex_messages_send_attachment_as_logged_in_user -- Hybrid mode only. Send an attachment as the logged-in OAuth user instead of the bot.
webex_messages_send_adaptive_card_as_logged_in_user -- Hybrid mode only. Send an Adaptive Card as the logged-in OAuth user instead of the bot.
webex_messages_get -- Get a message by ID. Enriched with sender profile, room info, and file content (text files inline).
webex_messages_delete -- Delete a message by ID

Rooms / Spaces

webex_rooms_list -- List rooms (filter by teamId, type, sortBy)
webex_rooms_create -- Create a room (title required, optional teamId)
webex_rooms_get -- Get room details by ID
webex_rooms_update -- Update room title
webex_rooms_delete -- Delete a room

Teams

webex_teams_list -- List teams
webex_teams_create -- Create a team (name required)
webex_teams_get -- Get team details by ID
webex_teams_update -- Update team name

Memberships

webex_memberships_list -- List memberships (filter by roomId, personEmail)
webex_memberships_create -- Add person to room (roomId + personEmail or personId)
webex_memberships_update -- Update membership (set isModerator)
webex_memberships_delete -- Remove person from room

Meetings

webex_meetings_list -- List meetings (filter by meetingType, state, from, to). Note: meetingType is required when state is used.
webex_meetings_create -- Schedule a meeting with optional invitees (title, start, end required; invitees accepts comma-separated emails)
webex_meetings_get -- Get meeting details by ID
webex_meetings_update -- Update a meeting
webex_meetings_patch -- Partially update a meeting (PATCH semantics)
webex_meetings_delete -- Cancel/delete a meeting
webex_meetings_list_participants -- List who actually attended a past meeting (join/leave times, host status, devices)
webex_meetings_get_participant -- Get a specific participant by ID

Transcripts

webex_transcripts_list -- List meeting transcripts (filter by meetingId, hostEmail, date range)
webex_transcripts_download -- Download transcript content (requires transcriptId + meetingId, optional format: txt or vtt)
webex_transcripts_list_snippets -- List spoken segments from a transcript
webex_transcripts_get_snippet -- Get a specific transcript snippet
webex_transcripts_update_snippet -- Update/correct a transcript snippet's text

Recordings

webex_recordings_list -- List meeting recordings (filter by meetingId, hostEmail, date range)
webex_recordings_get -- Get recording details by ID
webex_recordings_download -- Download recording content

Streaming

webex_subscribe_room_messages -- Subscribe to real-time messages in a room
webex_subscribe_mentions -- Subscribe to messages that @mention an email or are sent as direct (1:1) messages to that user
webex_subscribe_direct_messages -- Subscribe to 1:1 direct-message conversations for a user
webex_subscribe_messages_from_person -- Subscribe to messages sent by a person (personEmail), optionally scoped to rooms, with mentionsOnly to require a mention of you or @all
webex_unsubscribe -- Unsubscribe from a subscription
webex_wait_for_message -- Wait (blocking, one-shot) for the next message in a room
webex_wait_for_message_in_room_from_person -- Wait (blocking, one-shot) for the next message sent by a person (personEmail), with the same rooms / mentionsOnly scoping
webex_list_subscriptions -- List active subscriptions

Webhooks

webex_webhooks_list -- List webhooks
webex_webhooks_create -- Create a webhook (name, targetUrl, resource, event required)
webex_webhooks_get -- Get webhook details by ID
webex_webhooks_update -- Update a webhook
webex_webhooks_delete -- Delete a webhook

Architecture

webex-go-mcp/
  main.go       -- Cobra CLI + Viper config, mode branching (STDIO/HTTP)
  server.go     -- MCP server setup, STDIO + HTTP server startup
  auth/
    client_resolver.go  -- ClientResolver type (static for STDIO, context-based for HTTP)
    discovery.go        -- RFC 9728 + RFC 8414 well-known metadata endpoints
    middleware.go       -- Bearer token auth middleware, transparent token refresh
    oauth.go            -- /authorize, /callback, /token (proxies Webex OAuth)
    registration.go     -- RFC 7591 Dynamic Client Registration
    store.go            -- In-memory token store, auth code store, pending auth state
  tools/
    filter.go         -- ToolRegistrar interface, tool include/exclude filtering
    enrich.go         -- Response enrichment helpers (person names, room info, files)
    messages.go       -- 6 message tools
    rooms.go          -- 5 room tools
    recordings.go     -- 3 recording tools
    teams.go          -- 4 team tools
    memberships.go    -- 4 membership tools
    meetings.go       -- 8 meeting tools
    transcripts.go    -- 5 transcript tools
    webhooks.go       -- 5 webhook tools
  streaming/
    manager.go        -- Real-time subscriptions (subscribe, unsubscribe, wait_for_message, list_subscriptions)

Dependencies

mcp-go -- MCP server framework (STDIO + Streamable HTTP)
webex-go-sdk -- Webex API client
cobra -- CLI framework
viper -- Configuration management

License

MPL-2.0

Name		Name	Last commit message	Last commit date
Latest commit History 51 Commits
.github/workflows		.github/workflows
auth		auth
streaming		streaming
tools		tools
.gitignore		.gitignore
README.md		README.md
go.mod		go.mod
go.sum		go.sum
main.go		main.go
main_test.go		main_test.go
server.go		server.go
server_test.go		server_test.go

Folders and files

Latest commit

History

Repository files navigation