How to Add an MCP Server to Your Website (Without Opening a Security Hole)

🔌 MCP · Updated October 2026 · 7 min read · by Jacob Campbell

The Model Context Protocol (MCP) is the open standard AI assistants use to call tools. Most people meet it as a way to connect Claude or ChatGPT to their own apps, but it works just as well in the other direction: a website can publish its own MCP server, so any assistant can look up its services, prices, hours and availability, and send it a request, directly and accurately. That is a different thing from being crawled. A crawler reads what you wrote last month; an MCP tool answers with what is true now. This guide covers what to expose, how the transport works, the 2025 additions to the spec that matter for public servers, and the security rules that keep it boring.

Key facts

• Nov 2024 — MCP introduced by Anthropic as an open protocol
• Streamable HTTP — The transport for remote servers since the 2025-03-26 spec revision
• 4 hints — Tool annotations: readOnly, destructive, idempotent, openWorld
• RFC 9728 — OAuth protected-resource metadata, used by MCP authorization

What an MCP server on a website actually does

An MCP server exposes three kinds of things: tools (functions the assistant can call), resources (documents it can read) and prompts (templates). For a business website, tools carry most of the value:

• list_services: what you offer, with prices or price ranges.
• get_hours: opening hours, including holidays.
• check_service_area: whether you cover a given town or postcode.
• search_content: search your articles or docs and return passages with URLs.
• request_quote: send you a lead with the customer’s details and request.

The first four only read. The last one writes. That split matters for everything that follows.

Choosing the transport: Streamable HTTP

MCP started with two transports: stdio, for servers running on the user’s own machine, and HTTP with Server-Sent Events for remote servers. The 2025-03-26 revision of the specification replaced the latter with Streamable HTTP: a single endpoint (for example https://example.com/mcp) that accepts JSON-RPC messages by POST and can optionally stream responses. For a website this is the right choice; it runs on ordinary hosting and passes through ordinary CDNs.

A minimal exchange looks like this:

POST /mcp HTTP/1.1
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"tools/list"}

The server answers with its tool list. The client then calls tools/call with a tool name and arguments.

Tool annotations: tell clients what is safe

The same 2025-03-26 revision added tool annotations, hints that tell a client how a tool behaves so it can decide whether to ask the user first:

• readOnlyHint: the tool does not change anything.
• destructiveHint: the tool may delete or overwrite.
• idempotentHint: calling it twice has the same effect as once.
• openWorldHint: the tool reaches outside your own system.

Mark every lookup tool readOnlyHint: true. Mark request_quote as not read-only and not destructive. Clients use these hints to decide when to confirm with the user, and scanners use them to judge quality. Annotations are hints, not security; your server must still enforce its own rules.

Output schemas: typed answers

The 2025-06-18 revision added structured tool output: a tool can declare an outputSchema (JSON Schema) and return structuredContent that matches it, alongside the usual text. For a public website this is a quiet but real improvement. An assistant that receives {"open": "07:00", "close": "17:00", "timezone": "America/New_York"} does not have to parse a sentence to know when you open, and it can check the answer against the schema.

Authorization: public reads, protected writes

Most website tools should be public: anyone may ask what you offer. Where a tool needs authorization (an account lookup, a booking change), MCP’s authorization spec builds on OAuth 2.1 and, since 2025-06-18, requires servers to publish OAuth 2.0 Protected Resource Metadata (RFC 9728) at /.well-known/oauth-protected-resource. That document tells a client which authorization server to use. Even a fully public server benefits from publishing it, because it lets clients and scanners confirm that no authorization is required rather than guessing.

Security rules for a public MCP server

1. Expose facts, not systems. A tool that returns your service list is safe. A tool that runs arbitrary database queries is not.
2. Validate every argument against the input schema, and reject what does not match.
3. Rate-limit by IP and by tool, especially write tools. A quote request tool without a limit is a spam form with extra steps.
4. Never echo secrets. No API keys, internal URLs or stack traces in errors.
5. Treat tool input as untrusted text. A lead submitted by an AI agent can contain prompt-injection text aimed at whoever reads it next. Display it as data.
6. Validate the Origin header on the endpoint, as the Streamable HTTP spec recommends, and serve it only over HTTPS.
7. Log calls so you can see which assistants use which tools.

Making it discoverable

A server nobody can find is not much use. Advertise it in three places: an MCP server card or manifest under /.well-known/, a line in your llms.txt, and a link from your agent card if you publish one. Our guide to agent discovery files covers each. Then submit the endpoint to MCP registries and directories so people can add it to their assistants by name.

Three ways to get one

• Build it yourself. The official SDKs (TypeScript, Python and others) make a basic server a day of work; a robust, rate-limited, well-annotated one takes longer. See custom MCPs for your company for larger builds.
• Drop it in. The AI Indexing Pack includes a working PHP MCP server on Streamable HTTP, with typed output schemas and tool annotations, plus the discovery files, for any Apache or LiteSpeed host.
• Build it from blocks. On AIWebBuilding an owner can switch on an MCP server for their site without code.

However you build it, test it: WebAgentScan checks a live MCP endpoint for protocol compliance, annotations and security basics. Our own server is live at /mcp; see how this site is agent-ready.

Product facts: the AI Indexing Pack

Stated plainly, so it can be checked against the product page:

• What it is: the AI Indexing Pack is a set of files you upload to your own website. It is sold by Built2WinWeb as a one-time purchase, with no subscription.
• What it ships: (1) a working MCP server using the Streamable HTTP transport, with typed output schemas and tool annotations; (2) Markdown content negotiation, so agents can request a clean text version of each page; (3) llms.txt, agents.txt and agent cards; (4) the full /.well-known/ discovery tree; (5) OAuth protected-resource metadata; (6) bot access control that verifies crawler identity; (7) a README with a verification checklist.
• Requirements: PHP 7.4 or newer, Apache or LiteSpeed with .htaccess support, FTP access, and a domain you control. Installation takes about 30 minutes.
• What it is not: it is not a WordPress plugin (that is the separate WordPress edition, which needs WordPress 6.0+ and PHP 8.0+), it does not write content for you, it does not guarantee rankings or citations, and it is not a managed service.
• Free routes in: sites built on AIWebBuilding get the core built in, and a 50-day streak on FreeAIBoost unlocks the pack for one domain. Current prices are on the product pages.

Related reading

• Agent discovery files explained — agents.txt, agent cards, server cards and the .well-known tree.
• Custom MCPs for your company — Connecting AI to your own systems, securely.
• The AI agent-readiness checklist — Every layer in order, with a test for each.
• How this site is agent-ready — Our own live setup: the MCP endpoint, llms-full.txt, Markdown twins and the .well-known tree.
• AI Indexing Pack — The file-drop kit: MCP server, Markdown pages, llms.txt, discovery files and bot access control for any PHP site.
• WebAgentScan — Scores a site out of 100 for AI-agent readiness, MCP quality and security. Paid plans from $9 a month.
• AIWebBuilding — A website builder with the AI Indexing Pack core built into every published site.

Frequently asked questions

What is an MCP server?

An MCP server is a program that exposes tools, resources and prompts to AI assistants over the Model Context Protocol, an open standard introduced by Anthropic in November 2024.

Why would a website need an MCP server?

It lets AI assistants get live, accurate answers about the business, such as services, prices, hours and service area, and send requests directly, instead of relying on a crawled copy of the site.

Which transport should a website MCP server use?

Streamable HTTP, introduced in the 2025-03-26 revision of the MCP specification. It uses a single HTTPS endpoint and works on ordinary web hosting.

What are MCP tool annotations?

Hints that describe how a tool behaves: readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Clients use them to decide when to ask the user before calling a tool.

Does a public MCP server need OAuth?

Read-only public tools do not need authorization. Servers that protect any tool publish OAuth 2.0 Protected Resource Metadata (RFC 9728) at /.well-known/oauth-protected-resource, as the MCP authorization spec requires.

Is it safe to put an MCP server on my website?

Yes, if it exposes facts rather than systems, validates input, rate-limits write tools, never returns secrets, and treats incoming text as untrusted.

How do I test my MCP server?

Call tools/list and tools/call with an MCP client or curl, then run a check on WebAgentScan, which tests MCP endpoints for compliance and security basics.