MCP (Model Context Protocol) is the standard an AI client uses to discover and call tools that a server exposes. Once it is connected, the client sends a tools/list request and receives every tool the server offers with a name, a description, and an input schema, then invokes one with tools/call. That is the whole protocol shape: capabilities the server owns, presented as typed tools the model can call.
What MCP is for developers
Before MCP, wiring a model to your APIs meant per-client glue: a Claude plugin, a Cursor rule, a handful of HTTP calls embedded in a system prompt. Each client had its own mechanism, and each integration was its own security boundary to reason about. MCP standardizes the discovery and invocation layer. Any client that speaks the protocol can enumerate your tools and call them, and the server decides which tools exist and how they execute.
Transports matter here. A stdio client launches the server locally, the way a coding assistant does. Apps such as Claude Desktop can also reach a server over a remote HTTP transport with OAuth, which is where scoped credentials become the boundary instead of whatever ambient token the client happened to hold.
For a developer the practical shift is that the platform's capabilities become callable primitives the model can select at runtime, instead of API knowledge it has to infer.
Why a CPaaS MCP server matters
Communications APIs are action APIs: send a message, place a call, buy a number, start a campaign. An AI client that can only search documentation still cannot act. A read-write MCP server closes that gap, and Orbit by Devotel ships one as part of the platform, not as a separate product.
Two capability layers make it safe to hand an AI client read-write access:
- Scoped credentials via OAuth 2.0 Token Exchange (RFC 8693). An agent holding a scoped access token can exchange it at
POST /agents/:id/token-exchangefor a shorter-lived credential narrowed to the tools the task needs; the result is never wider than what it already held. The exchanged token carries a signed delegation chain naming the agent and its human sponsor, so an audit review can read which agent acted, on whose behalf, and with which permissions straight out of the credential. Requests that try to impersonate without that attribution are refused. - URL-mode elicitation for sensitive values. Some tools need a one-time secret: a payment-mandate confirmation code, an authorization token from a connected provider. Instead of asking for the value in a chat form, the server returns a link to a secure, Orbit-hosted page. Each link is single-use and expires after 15 minutes, so the secret goes straight to Orbit and the link cannot be replayed. Clients that do not support elicitation yet are unaffected; confirmation prompts before a tool sends a message or deletes data stay as they are.
Together those mean tool calling stops being "whatever the agent's ambient token can reach" and becomes a narrowable, attributable, prompt-gated action surface. The connection guide in the docs walks through wiring a specific client.
Worked examples
All three examples assume a connected MCP client; the connection guide covers Claude Desktop, Claude Code, and Cursor configs.
List numbers on the account
A read call, low-risk by definition, returning whatever inventory the account holds today. In a client with the Orbit MCP server connected, a prompt like "List the phone numbers on this Orbit account and their voice and SMS capabilities" causes the model to call the numbers-listing tool with no arguments and return the inventory it finds, without you writing a query by hand. Read-only tools like this one never prompt for confirmation; the confirmation gate is reserved for actions that send, spend, or delete.
Trigger a flow run
Starting a published flow is a state-changing action, which is exactly where the tool surface pays off. The docs define flows as the journey primitives a tenant builds and publishes, and the Executions API records every run: which nodes fired, what their inputs and outputs were, and any errors raised.
The MCP server exposes the flow surface as paired tools: list_journeys enumerates the tenant's published flows so the model picks a real flow_id by name rather than guessing, and start_journey enrolls a contact or a list into that flow. Start one from the client with a prompt like "Start the 'Inbound SMS auto-responder' flow for contact ct_9182 and pass a context of source=support." Because start_journey is a spend-adjacent action, it sits in the confirmation gate, so an elicitation-capable client will ask before firing.
Elicitation for a sensitive input
The third pattern is the one that matters most for security review. When a tool needs a sensitive value that must not pass through the chat window, a confirmation code on a payment mandate or a provider authorization token, an elicitation-capable client receives a link to an Orbit-hosted page instead of a form prompt. The link is single-use and expires after 15 minutes. The client never sees the plaintext, the value lands directly at Orbit, and the call continues once the page submits it.
If your client predates elicitation, nothing changes and the call proceeds as before; the URL-mode step applies only where the client advertised the capability. That asymmetry is deliberate: no tool should fall into plaintext-in-chat just because an older client is connected.
Further reading
The comparative listicle ranks Orbit's server against other CPaaS MCP servers on tool coverage and native agent-runtime depth: Best MCP Server for Communications & CPaaS 2026.
The token-exchange capability claim came out of the work described in Scoped agent credentials, pinned regression replay, and the Agent ROI guide, and the elicitation behavior out of Orbit release notes — August 2026.
Frequently asked questions
Is the Orbit MCP server free to use?
The server itself has no separate licence fee; connect with your existing Orbit API key. Tool calls that consume billable resources (sending a message, placing a call) debit your normal pay-as-you-go balance at the same published per-unit rates as the API and dashboard, and you can cap spend or restrict the server to read-only tools per session.
Which MCP clients does the Orbit server support?
The connection guide covers the common ones: Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Cline, and Zed. It runs over the stdio transport, and the protocol stays open to any other MCP-capable client on the same OAuth or scoped-credentials model.
What stops an AI client from spending money through Orbit?
Three layers. Confirmation prompts gate the tools that send, spend, or delete. Scoped credentials via Token Exchange narrow the credential to the tools the task needs. URL-mode elicitation takes sensitive one-time values out of the chat window entirely. A client that predates those features still cannot call read-write tools unless the credential it holds was scoped to include them.