https://retellai.com/?utm_source=discord&utm_medium=seo logo
Powered by
Hey can you tell me how can we make our mcp secure...
# ❓・ai-evy-support
n
@AI Evy Hey can you tell me how can we make our mcp secure like can we do the same thing we do in webhook and verify the retell way
a
Thanks for tagging me @neerajjoshi_. I'll look through relevant sources and get back to you shortly.
### Answer MCP (Model Context Protocol) security in Retell AI works differently than webhook verification [(1) ]() . For MCP servers, authentication is handled through the Authorization header with your Retell API key . When connecting to the MCP server, you authenticate using: 
Authorization: Bearer <RETELL_API_KEY>
. This ensures that only authorized requests with valid API keys can access your MCP tools . The MCP security model focuses on: - Keeping API keys out of prompts and storing them in client secrets/settings - Using least privilege by creating keys with minimum required permissions - Verifying the server URL and auth header to ensure the client can reach the endpoint Unlike webhooks which use the 
x-retell-signature
header for verification [(2) ]() [(3) ]() , MCP relies on bearer token authentication with your API key [(1) ]() . The platform doesn't provide the same signature-based verification mechanism for MCP that it does for webhooks [(2) ]() [(1) ]() . For additional security, you should enable "confirm before running tools" in your MCP client to review tool calls before execution [(1) ]() .
​ To learn more, see the sources I considered: [[1] MCP Server](https://docs.retellai.com/get-started/mcp-server) [[2] Secure the webhook](https://docs.retellai.com/features/secure-webhook) [[3] Webhook Overview](https://docs.retellai.com/features/webhook-overview) ​
Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.
n
@AI Evy no not retell
a
Thanks for the follow-up, @neerajjoshi_. I'll get back to you soon.
n
@AI Evy no not retell
a
### Answer I understand you're asking about securing your own MCP server (not Retell's MCP server) when Retell AI calls it. When you set up an MCP in Retell AI, you can add custom request headers to secure your endpoint [(1) ]() . This allows you to implement your own authentication mechanism on your MCP server side. For example, you can: - Add an Authorization header with a secret token - Add custom headers for verification - Validate these headers on your MCP server before processing requests However, Retell AI does not currently send a signature header (like 
X-Retell-Signature
used for webhooks [(2) ]() [(3) ]() ) when calling your MCP server. The security relies on: - Custom headers you configure [(1) ]() - Your Retell API key used in the Authorization header when connecting to Retell's MCP server [(4) ]() - Keeping your MCP server endpoint private/not publicly exposed If you need webhook-style signature verification for your MCP server, you would need to implement your own signing mechanism using the custom headers feature [(1) ]() .
Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.
n
@AI Evy okay can we whitelist ips from retell to give retell only access to our mcp?
a
Thanks for the follow-up, @neerajjoshi_. I'll get back to you soon.
### Answer Yes, you can whitelist Retell AI's IP address to restrict access to your MCP server. According to the documentation on custom functions (which follows a similar pattern) , you can secure your server by only allowlisting Retell IP addresses: 
100.20.5.228
[(1) ]() . This same IP allowlisting approach should work for securing your MCP endpoint, ensuring that only requests originating from Retell AI can reach your MCP server .
​ To learn more, see the sources I considered: [[1] Integrate any system with custom function](https://docs.retellai.com/build/single-multi-prompt/custom-function) ​
Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.
PreviousNext
Powered by