> ## Documentation Index
> Fetch the complete documentation index at: https://boundbot.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to BoundBot through MCP

> Create a team API key and connect an external AI client to BoundBot's hosted MCP server.

BoundBot exposes a hosted Model Context Protocol server for external AI clients. Use it when you want a compatible client to work with the current team's bots, conversations, knowledge, products, leads, orders, channels, and dashboard data.

This is the opposite direction from <a href="/docs/guides/connected-mcps">Connected MCPs</a>: **Connected MCPs** give a BoundBot bot access to an external server, while the **BoundBot MCP server** gives an external client access to BoundBot.

## Create an API key

<Steps>
  <Step title="Open API Keys">
    Go to <a href="https://www.boundbot.com/dashboard/settings/api-keys" target="_blank" rel="noopener noreferrer"><b>Settings</b> → <b>API Keys</b></a> in the team you want the client to access.
  </Step>

  <Step title="Create a named key">
    Select **Create API Key** and use a label that identifies the client or device, such as `Support laptop`.
  </Step>

  <Step title="Copy it immediately">
    Copy the full `sk_...` value from the success dialog. BoundBot stores only a hash and shows the full key once.
  </Step>
</Steps>

<Warning>
  A key is team-scoped and is not limited to read-only tools. It can send customer messages and create, update, or permanently delete supported records. Store it as a secret, review tool calls in your AI client, and never put it in browser code, a public repository, or a shared screenshot.
</Warning>

## Configure the MCP client

Use the hosted Streamable HTTP endpoint:

```text theme={null}
https://api.boundbot.com/v1/mcp
```

Send the API key as a bearer credential on every request:

```text theme={null}
Authorization: Bearer YOUR_BOUNDBOT_API_KEY
```

A client's configuration shape varies, but the connection needs these values:

```json theme={null}
{
  "name": "boundbot",
  "transport": "streamable-http",
  "url": "https://api.boundbot.com/v1/mcp",
  "headers": {
    "Authorization": "Bearer YOUR_BOUNDBOT_API_KEY"
  }
}
```

Save the connection and ask the client to list available tools. A successful request updates **Last Used** for the key in BoundBot.

## Available tool groups

| Area           | Current capabilities                                                                       |
| -------------- | ------------------------------------------------------------------------------------------ |
| Dashboard      | Read the analytics overview for a preset or custom date range.                             |
| Bots           | List bots, read one bot, and update its name, instructions, welcome message, or AI status. |
| Channels       | List connected channels and their status.                                                  |
| Conversations  | List conversations, read messages, send a text or image reply, and mute or unmute the bot. |
| Knowledge base | List, read, create, and permanently delete FAQ-style knowledge items.                      |
| Products       | List, search, read, create, update, and permanently delete products.                       |
| Leads          | List, read, create, update, and permanently delete leads.                                  |
| Orders         | List, read, create, update, and permanently delete orders.                                 |

The server does not currently expose native scheduling, inventory operations, or Point of Sale tools. Normal BoundBot plan limits, ownership boundaries, channel reply windows, and record validation still apply when an MCP tool runs.

## Rotate or revoke access

The API Keys table shows each key's name, masked prefix, creation time, and last-used time. BoundBot does not show the secret again.

To rotate a credential:

1. create a replacement key
2. update the MCP client and verify it connects
3. revoke the old key from its row menu

Revocation takes effect immediately. Any client still using that key loses access.

## Troubleshooting

**The client receives `401 Unauthorized`**

* Confirm the header starts with `Bearer ` followed by the complete key.
* Copy the replacement key into the client if the original was revoked.
* Check that a proxy or secret manager is not removing the `Authorization` header.

**The connection succeeds but a write fails**

* Confirm the record belongs to the key's team.
* Check required fields and the team's plan or capacity limit.
* For customer replies, confirm the destination channel is active and any reply window is still open.

**The expected tool is missing**

* Reconnect the client so it refreshes the server's tool list.
* Check the table above; scheduling, inventory, and POS are not currently exposed.

## Related pages

<CardGroup cols={2}>
  <Card title="Team settings" icon="users" href="/docs/guides/team-settings">
    Manage the team that owns the API key.
  </Card>

  <Card title="Connected MCPs" icon="cable" href="/docs/guides/connected-mcps">
    Let a BoundBot bot call tools on an external MCP server.
  </Card>

  <Card title="Inbox" icon="inbox" href="/docs/guides/inbox">
    Review conversations and messages affected by MCP tool calls.
  </Card>

  <Card title="Plans and limits" icon="badge-dollar-sign" href="/docs/reference/plans-and-limits">
    Check the limits that still apply to MCP-created records.
  </Card>
</CardGroup>