Jon Shulkin(@jon):Grok Build will make you a private MCP in an afternoon. One URL. Bearer JWT. No OAuth. Grokbots can use this to run everything extremely simply. What you ship: • Streamable HTTP: POST / GET / DELETE on /api/mcp • Auth: Authorization: Bearer <JWT> only 401 = mint a new token. Do not add Authenticate / OAuth / WWW-Authenticate — clients will wander off into a flow you do not have. • Identity in the JWT (tenant + sub). Grants in the database, not in the token. • Same URL for every seat. Different JWT per person. Wire it to Grok Build or a Grok Bot: 1. Add MCP → HTTP / SSE (not stdio) 2. Paste the URL 3. Header: Authorization: Bearer <JWT> 4. Save. tools/list should come back. That’s the whole client setup. On the server, keep it small: • Wrap the APIs your UI already has. No new business logic in the MCP layer. • Reads are free. Writes use the same propose / approve grants as a human. • Split draft vs post (two people, two JWTs). Never let one leaked token do both. • Do not wrap anything that sends money. • Fail closed: missing token → 401; abuse → 429; bad image never gets traffic until smoke is green. If a tool does not exist yet, say so. Do not stub it. Computer login is not a substitute for Bearer. You do not need an IdP, OAuth discovery, or a special bot SDK. A JWT, a JSON-RPC handler, and the tools you already run in the product.

2026.09.18 04:07

Grok Build will make you a private MCP in an afternoon. One URL. Bearer JWT. No OAuth. Grokbots can use this to run everything extremely simply. What you ship: • Streamable HTTP: POST / GET / DELETE on /api/mcp • Auth: Authorization: Bearer only 401 = mint a new token. Do not add Authenticate / OAuth / WWW-Authenticate — clients will wander off into a flow you do not have. • Identity in the JWT (tenant + sub). Grants in the database, not in the token. • Same URL for every seat. Different JWT per person. Wire it to Grok Build or a Grok Bot: 1. Add MCP → HTTP / SSE (not stdio) 2. Paste the URL 3. Header: Authorization: Bearer 4. Save. tools/list should come back. That’s the whole client setup. On the server, keep it small: • Wrap the APIs your UI already has. No new business logic in the MCP layer. • Reads are free. Writes use the same propose / approve grants as a human. • Split draft vs post (two people, two JWTs). Never let one leaked token do both. • Do not wrap anything that sends money. • Fail closed: missing token → 401; abuse → 429; bad image never gets traffic until smoke is green. If a tool does not exist yet, say so. Do not stub it. Computer login is not a substitute for Bearer. You do not need an IdP, OAuth discovery, or a special bot SDK. A JWT, a JSON-RPC handler, and the tools you already run in the product.