How the MCP Server Works

This tutorial covers the basics of what happens behind the scenes when you connect an AI tool to Everwall: the connection URL, how you sign in, how permissions keep things safe, and a couple of behaviors that are worth understanding so the AI behaves the way you expect.

You don’t need any of this to use the server — but a few minutes here will save you confusion later.

The connection URL

Everything runs through a single HTTPS endpoint:

https://mcp.everwall.com/mcp

This is the only address you’ll paste into your AI tool. The server speaks MCP over Streamable HTTP, which every current MCP-compatible tool supports, so there’s nothing to install or run locally — Everwall hosts it for you.

A few other public addresses exist on the same host, but you’ll rarely touch them directly:

Signing in

Signing in is a one-time step, and there’s nothing to copy or paste. When you add the server to your AI tool, the tool prompts you to log in to Everwall; you approve, and you’re connected.

Behind the scenes this uses OAuth 2.1 with PKCE and Dynamic Client Registration. It’s the same secure standard behind connectors for Gmail, Google Calendar, and Slack:

1. You add https://mcp.everwall.com/mcp to your AI tool.
2. The tool opens a secure Everwall sign-in window.
3. You log in the way you always do and choose which account(s) and permissions to grant.
4. Everwall hands the tool a token automatically so it never sees your actual Everwall password.

The same flow works everywhere — Claude (web and desktop), ChatGPT, Claude Code, and OpenAI Codex all prompt you to log in when you add the server. The tool can never do anything you didn’t approve.

Reviewing and revoking access

Every connection you approve shows up as an authorization in your Everwall account, so you’re always in control:

• Your own authorizations: account.everwall.com/my-api-keys — see what you’ve connected and revoke any of it instantly.
• Every API/MCP connection authorized for an account (for owners/admins): account.everwall.com/account-api-keys.

Revoking takes effect immediately across every tool using that authorization.

Advanced / headless use: for scripts, CI, or fully unattended automation that can’t open a browser, Everwall also supports long-lived API-key tokens (they start with ewut_). Most people never need one because the login flow above covers Claude, ChatGPT, Claude Code, Codex, and just about every other AI tool that supports MCP servers. Get in touch if you have a headless case.

Permissions: what the AI is allowed to do

Access is enforced in three layers, checked on every single tool call:

1. Is the token valid? Not expired, not revoked.
2. Do you have access to this account and wall? The token can only reach the accounts and walls your Everwall login already has access to. If your login is limited to certain walls, the token is too.
3. Does the token’s permission scope allow this action? Reading is separate from moderating, which is separate from editing, announcements, polls, and so on.

That third layer is the scope system. When you sign in, you choose which of these to grant:

Two things worth knowing:

• Every scope includes read access. If you grant any permission, the AI can also read. Read Only is the floor, not a separate thing you have to add.
• A connection can never exceed your own access. If your Everwall account only lets you view (not moderate) a wall, a tool you connect can’t moderate it either, even if you grant the Moderate scope. Permissions are clamped to what you personally can do, both when you sign in and every time a tool is used.

Grant the narrowest set of scopes that gets the job done. A read-only key is perfect for a stats dashboard; save Full Access for a trusted moderation assistant.

Rate limits

AI agents can be enthusiastic, they’ll happily fire off dozens of calls in a second. To keep walls healthy, the server applies sensible per-credential limits:

• Reads: about 120 per minute, with room for short bursts (an AI exploring a wall might chain list-walls → get-wall → list-posts → get-stats).
• Writes: about 30 per minute — writes are heavier because they ripple out to the live wall, leaderboards, and the activity log.
• A few tools have their own tighter limits (bulk moves, reservations, Connect submissions, and ranged stats), because each call fans out into a lot of work in other systems.

If you hit a limit, the tool returns a clear “slow down” error and the AI will typically wait and retry. For normal interactive use you’ll never notice these.

Two behaviors that surprise people

Post counts are a snapshot

Any count the AI reports — “42 posts in the moderation queue” — is a point-in-time number. On a busy wall with other moderators working, it can be stale within seconds. The AI knows to re-check with a fresh count before making decisions that depend on it, so don’t be surprised if it double-checks the queue size mid-task.

The tool list can lag behind

When your AI conversation starts, it takes a snapshot of the available tools. Everwall ships new tools regularly, so a long-running chat might not see the newest ones. If you ask for something the AI says it can’t do, ask it to run the ping tool — that reports the current tool list. If new tools show up there, reconnect (or “refresh tools”) in your AI tool, or start a fresh chat, and they’ll appear.

Next steps

Ready to connect? Head to Connecting Your AI Tool for step-by-step setup in Claude, ChatGPT, Claude Code, and Codex.