Model Context Protocol
Kesk runs MCP servers so AI assistants can act on the platform — order dinner, restock the office, book a ride, check today's orders — with your approval.
Works with Claude, ChatGPT, Codex, Gemini, Cursor, VS Code, Siri, Perplexity, DeepSeek, Kimi, Hermes and Copilot.
Two surfaces
| Surface | For | Endpoint |
|---|---|---|
Consumer | Your own Kesk account | https://mcp.kesk.app/v1/users |
Vendor | A business you run, per vertical | https://vendors.apis.kesk.app/v1/{vertical}/mcp |
Personal and vendor access are kept apart. A consumer connector cannot reach vendor operations, and vice versa.
Signing in
Authentication happens in your AI client. You connect the server, approve access with your Kesk account, and the client handles tokens from there. There are no keys to generate, copy or rotate by hand.
You grant only what you choose, and can disconnect at any time. Money-moving actions are surfaced for confirmation rather than executed silently.
What the tools do
Vendor tools map onto the same operations as the Vendor GraphQL APIs — read orders, accept an order, update a price, manage locations and webhooks — with the same permission checks behind them.
See Vendor tools.
Transport details
Only relevant if you are building your own MCP client rather than using an assistant.
Streamable HTTP, protocol version 2025-06-18. JSON-RPC over POST; responses
come back as SSE frames.
The Accept header must include both application/json and
text/event-stream. Omitting text/event-stream returns 406 Not Acceptable.
The result identifies the server as kesk-mcp:
initialize returns an mcp-session-id header — send it on every subsequent
request in the session. It succeeds without credentials, but tools/list and
every tool call return 401 without a bearer token, so it is easy to think you
are authenticated when you are not.
The server advertises the tools capability only — no resources, no prompts.
Common questions
Do I need an API key?
No. Authentication happens in your AI client — you approve access with your Kesk account when it first connects, and there is nothing to copy, paste or rotate by hand.
Can a consumer connector reach vendor operations?
No. Personal and vendor access are kept apart, and neither reaches the other.
Will an assistant spend money without asking?
Money-moving actions are surfaced for confirmation rather than executed silently, and you can disconnect at any time.
Do the tools match the GraphQL API?
Where a tool has a GraphQL equivalent, both are gated by the same scope. But the advertised tool list is wider than the vertical's GraphQL schema, so read Vendor tools before deciding what to grant.
Which clients work?
Claude, ChatGPT, Codex, Gemini, Cursor, VS Code, Siri, Perplexity, DeepSeek, Kimi, Hermes and Copilot. See Add to your AI client.
Why doestools/listreturn 401 wheninitializeworked?
Because initialize succeeds without credentials. tools/list and every tool
call need a bearer token, so it is easy to think you are authenticated when you
are not.