NextKS · MCP Server Host

NextKS MCP Servers

A host for standalone, stateless MCP servers that extend NextKS Voice with real-world capabilities. Each server is an isolated, credential-free proxy to one external service — enable only the ones you need.

Independent servers
Each server has its own endpoint at /api/mcp/<server> and is registered separately in NextKS.
OAuth (BYOK)
Each is added as an OAuth “bring your own key” MCP connector — NextKS owns the sign-in and tokens.
Stateless & isolated
No server stores tokens or credentials, and servers are isolated from each other and from NextKS core.
Minimal surface
Each exposes a small, auditable set of tools that map one-to-one to the upstream API.

Available servers

More servers — coming soon

Microsoft 365

mail & calendar · via Microsoft Graph

A stateless Microsoft Graph proxy that lets NextKS Voice read and act on a Microsoft 365 user's mail and calendar. It forwards the signed-in user's delegated Graph token verbatim, returns compact results, and is agnostic to which customer or user is calling.

What it can do

📧 Mail

list_messages
Recent messages — sender, subject, received time, preview.
search_messages
Free-text search across the mailbox.
read_message
One message with its full body and metadata.
send_messagewrite
Send an email as the user — one call, one send.

📅 Calendar

list_events
Events in a time window; recurring meetings expanded.
read_event
Full event detail — attendees, body, web link.
create_eventwrite
Create a calendar event — one call, one event.

Responses are compact projections, never raw Graph payloads. The two write tools are never retried and are designed to sit behind the connector's “require approval” gate.

Register in NextKS

Add this server in NextKS as an OAuth (BYOK) MCP connector, using its endpoint:

https://nextks-2-mcp-servers.vercel.app/api/mcp/o365
  • Connector type — OAuth · bring your own key (BYOK)
  • Transport — MCP Streamable HTTP (stateless)

Under the hood, the NextKS OAuth (BYOK) connector runs the Microsoft sign-in, obtains a delegated Microsoft Graph token, and attaches it to every request as Authorization: Bearer …. You never set a token by hand — this server simply consumes whatever the connector supplies.

Required API permissions

The OAuth app your connector uses must consent to these delegated Microsoft Graph permissions. A missing scope surfaces as a permission error (HTTP 403) the first time the matching tool is used.

PermissionTypeGrants
Mail.ReadDelegatedList, search, and read messages
Mail.SendDelegatedSend mail as the user
Calendars.ReadDelegatedList and read calendar events
Calendars.ReadWriteDelegatedCreate calendar events
User.ReadDelegatedBaseline sign-in and identity
offline_accessDelegatedRefresh token (keeps access alive; used connector-side)

Where to grant them

On the Microsoft Entra app registration your connector uses for Microsoft 365:

  1. Microsoft Entra admin center → App registrations → your app.
  2. API permissions → + Add a permission → Microsoft Graph → Delegated permissions.
  3. Select the six permissions above, then Add.
  4. Click Grant admin consent for your tenant.

All permissions are delegated (the server always acts as the signed-in user), never application permissions. Creating the app registration, obtaining and refreshing tokens, and tenant configuration are connector-side setup — the same for any bring-your-own third-party MCP.

Security & isolation

These principles hold for every server hosted here.

  • Stateless — no token storage, cache, refresh, or database.
  • Credential-free — no client ID, client secret, or tenant ID lives in a server; the NextKS connector owns all OAuth.
  • User-scoped — delegated tokens only; every call runs as the signed-in user, limited to their own data — never another user's.
  • Safe writes — write tools perform exactly one action, are never auto-retried, and are meant to run behind the connector's approval gate.
  • Isolated — each server is a separate endpoint, decoupled from the others and from the NextKS core.