Skip to main content
VoiceMatrix

MCP Server

Verified against backend/internal/mcpserver/ and backend/internal/oauth/ (2026-10-11): the OAuth flow is covered end to end by backend/internal/oauth/oauth_test.go, and every tool's annotations by backend/internal/mcpserver/annotations_test.go.

VoiceMatrix runs a live Model Context Protocol server so Claude, Claude Code, Cursor or any other MCP client can work with your account directly: review what your callers are saying, launch an agent in a new market, compare agents, and plan usage — without you writing REST calls by hand.

text
https://api.voicematrix.ai/mcp

It runs in-process in the Go API, not as a separate service, on the same tenancy path and the same scope checks as the REST surface.

Connect

Claude (claude.ai, Desktop, mobile)

Settings → Connectors → Add custom connector → paste https://api.voicematrix.ai/mcp → Connect. You sign in to VoiceMatrix, choose which permissions to grant, and you are done. No key to copy.

Claude Code

bash
claude mcp add --transport http voicematrix https://api.voicematrix.ai/mcp

Then run /mcp in a session and choose Authenticate. Claude Code opens the VoiceMatrix consent page in your browser and receives the connection on a local port.

Cursor, VS Code and other clients

Add the URL as a remote (HTTP) MCP server; clients that support MCP authorization discover the sign-in automatically.

With an API key instead

Every client that can send a header can still use a key minted in Settings → API keys:

bash
claude mcp add voicematrix \
  --transport http https://api.voicematrix.ai/mcp \
  --header "X-API-Key: vm_live_your_key_here"

How sign-in works

The server is an OAuth 2.1 authorization server, built to what Claude's connector client requires:

StepWhat happens
DiscoveryA request with no credential gets 401 and WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"; that document names the authorization server https://voicematrix.ai
Client identityClient ID Metadata Documents (Claude and Claude Code) or Dynamic Client Registration (others). Public clients only
ConsentYou sign in on voicematrix.ai and pick permissions. The page shows where you will be returned
TokensPKCE (S256) is required. Access tokens last 1 hour; refresh tokens 30 days, single-use and rotated. Presenting a used refresh token revokes the whole connection

Approving creates a connection that appears in Settings → API keys under the application's name. Revoking it there ends the connection immediately. Who may approve: account owners, admins and managers, on a plan that includes API access — the same rule as minting a key.

Permissions a connection can hold: agents:read, agents:write, calls:read, leads:read, leads:write, webhooks:manage. A connection can never place calls, bind phone numbers, delete agents, or run paid tests — those scopes are not grantable over OAuth at all.

The tools

Every tool declares a title and whether it is read-only or changes data, so Claude can run reads without asking and always confirms a write.

Read

text
whoami   list_agents   get_agent   list_calls   get_call   list_leads   get_lead
list_webhooks   webhook_deliveries   list_webhook_events
review_conversations   compare_agents   estimate_agent_usage

Write

text
create_agent   duplicate_agent   update_agent   publish_agent   unpublish_agent
create_lead   update_lead   create_webhook
ToolWhat it is for
review_conversationsSummaries, sentiment, urgency and tags of recent calls with counts — for spotting recurring questions and complaints. Never returns transcripts or caller phone numbers
duplicate_agentCopy an agent for a new market, changing its name, language, voice, greeting or prompt. The copy is a draft until you publish it
compare_agentsTwo to five agents side by side: which settings differ, which match, and simple inconsistencies
estimate_agent_usageCalls and minutes per day, projected minutes for the next 30 days against your plan's included minutes, average model tokens per call, and the relative model-cost change if you switch models

Each tool checks the same scope its REST equivalent requires; a connection or key missing it gets a clear tool error, not a silently smaller result. Creating or duplicating an agent runs the same account and plan checks as the dashboard. Results are minimized: transcripts are opt-in per call (get_call) and never part of a list.

What you can ask it

"Which topics come up most in my calls this week, and what are callers unhappy about?" "Duplicate my English receptionist for the Israeli market, in Hebrew with a female voice." "Compare my three agents and tell me what's inconsistent." "If I switch this agent to a cheaper model, how does its usage change next month?"

Next

All pages