CometChat MCP Server

Add real-time chat, voice, video, and moderation to your app through your AI coding agent.

Docs • CometChat • Get an account (free, 100 MAU)

CometChat's first-party MCP server. Connect Claude, Cursor, Windsurf, VS Code Copilot, Codex, or any other Model Context Protocol–compatible agent and integrate CometChat into your app from natural-language prompts.

Ask the agent: "add a chat tab where users can DM each other" — it reads CometChat's documentation, picks the right components for your stack, and writes the integration code.

One endpoint, /mcp. The docs tools are read-only, with no account, API key or authentication. Account tools (your apps, users, settings) need you to sign in with your CometChat account: your client asks you to sign in the first time you use one. See Account tools.

Demo

An AI agent reading CometChat's docs and writing a working chat integration from a single prompt.

Related MCP server: notifly-mcp-server

Quick install

Config snippet (Cursor / Windsurf / generic MCP clients)

{
  "mcpServers": {
    "cometchat": {
      "url": "https://mcp.cometchat.com/mcp"
    }
  }
}

Usage

After connecting, prompt your agent with any of these:

• "How do I install the React UI Kit in my Vite project?"

• "Walk me through multi-tenant chat for a Next.js SaaS where workspaces are isolated."

• "Show me how to add presence indicators and typing dots to my iOS conversation list."

• "Set up content moderation so banned words are blocked before delivery."

• "Build a no-code chat widget for my Webflow site."

• "What's the rate limit for sending messages, and what error code do I get when I hit it?"

The agent reads CometChat's documentation, pulls the relevant implementation bundle, and writes the integration code into your project.

Tools

• search_cometchat_docs — Search the SDK, UI Kit, Calls, REST API, AI agent, notification and moderation docs by topic, API name or error message. Returns ranked snippets with page URLs, current versions first. Optional version filter and limit (up to 25).

• fetch_cometchat_doc_page — Fetch one documentation page in full as markdown by URL or path, following moved pages. Pages over 50 KiB are truncated with a link to the full page.

• get_cometchat_implementation_bundle — Return the implementation bundle for a named scenario: the scenario's current docs pages (for a UI Kit: its integration guide, then the platform's AI reference page) compiled into one document, plus related page paths.

• list_cometchat_bundles — List every available implementation bundle (identifier, title, framework, date its page list was reviewed) for discovery.

All four carry readOnlyHint: true, a title annotation, and a declared outputSchema with structured results. Names are ≤ 64 characters. Each description states what the tool does, when it fits and its limits (errors, rate limit), naming this server's other tools only where one serves a specific need ("identifiers come from list_cometchat_bundles"). They carry no directives to the agent, no references to other servers or products, and no marketing language. tests/tools.test.ts guards the tool, parameter and output-field descriptions and the initialize instructions against a list of banned phrasings, and checks that list still rejects the shapes it was written for; it is a banlist, not a proof.

Resources

How it works

1. You prompt your agent in natural language.

2. The agent reads the orientation skill (cometchat://skills/overview) to understand which tool/bundle fits your request.

3. For top scenarios, the agent pulls an implementation bundle — the current docs pages for that integration in one document.

4. For long-tail questions, the agent searches CometChat's docs and reads specific reference pages.

5. The agent writes the code into your project, using the bundle as the source of truth and your project structure as the constraint.

CometChat in 30 seconds

CometChat is a real-time communications platform for adding chat, voice, and video calling to web and mobile apps. Used in production across SaaS, marketplaces, gaming, healthcare, education, and creator platforms.

• Free tier: first 100 monthly active users, no credit card required.

• SDKs: JavaScript, React Native, iOS, Android, Flutter.

• UI Kits: React, React Native, iOS, Android, Flutter, Angular, Vue.

• No-code: chat widget for any HTML site.

• Sign up: app.cometchat.com — you'll need an App ID, Auth Key, and Region to build with the code the agent writes.

Server identity

Architecture

Your agent (Claude / Cursor / Windsurf / …)
        ↓ MCP over Streamable HTTP
        ↓
  mcp.cometchat.com/mcp  (this server)
        ↓
  ├── search_cometchat_docs     → SQLite FTS5 index of cometchat/docs
  ├── fetch_cometchat_doc_page  → cometchat.com/docs/*.md (first-party)
  └── get_cometchat_implementation_bundle → live docs pages listed in src/bundles/manifest.ts

• Stateless server, single universal endpoint, no user-specific state.

• Search index rebuilds from github.com/cometchat/docs on every push to that repo's main branch.

• Implementation bundles have no content of their own. Each is a list of docs pages (src/bundles/manifest.ts), read from the live docs on request, so a docs fix reaches the bundle with no MCP change. A built bundle is served for 10 minutes; after that a call still gets it at once and starts one background rebuild. A rebuild that hits a timeout or 5xx never replaces the cached bundle and is retried with a backoff (30 s, doubling, up to 10 minutes), so a docs outage neither drops bundles nor floods the docs site. A deleted page (404) is what the docs say: once a second build in a row agrees, that rebuild is kept and names the missing page. npm run verify:bundles fails when a listed page moves, disappears, no longer fits in its bundle, is no longer the current version in docs.json, or tells people to install a package version that is unpublished, on an older major, or an exact pin a minor behind (checked against npm, pub.dev, CometChat's Maven repo, CocoaPods trunk and GitHub); the maintainers run it daily.

Local development

Node.js: running the server needs Node 20 or later. Developing and running the tests need Node 20.19+ or 22.12+, because the test toolchain (Vitest, Vite and Rolldown) won't start on earlier releases. CI uses Node 24.

# Clone the docs repo (used to build the search index)
git clone --depth 1 https://github.com/cometchat/docs.git ../cometchat-docs-repo

# Install + build the FTS index + run the server
npm install
DOCS_REPO=../cometchat-docs-repo npm run build:index
npm run dev

# Run the test suite (vitest: validation, truncation, bundles, tools, resources, fetch,
#  search ranking and the index builder)
npm test

# Score search ranking on the index you built (CI pins the docs commit: see DEPLOY.md)
DOCS_REPO=../cometchat-docs-repo npm run eval:search

# Check every docs page a bundle lists still exists and is current (network)
npm run verify:bundles

The server listens on http://0.0.0.0:3000 by default. Health probe at GET /health, MCP endpoint at POST /mcp.

Inspect with the MCP Inspector

npx @modelcontextprotocol/inspector
# add server: http://localhost:3000/mcp

You should see all 4 tools with readOnlyHint: true and all 11 resources.

Repo layout

docs-mcp/
├── src/
│   ├── server.ts                  # MCP server entry, transport, tool dispatch
│   ├── tools/{search,fetch,bundle}.ts
│   ├── search/sqlite.ts           # SQLite FTS5 client
│   ├── bundles/manifest.ts        # each bundle's docs pages
│   ├── bundles/loader.ts          # compiles bundles from live docs pages
│   ├── resources/registry.ts      # skill + bundle resources
│   └── lib/{errors,truncate,validation,logger}.ts
├── scripts/build-index.ts         # builds SQLite FTS5 index from cometchat/docs
├── skills/overview.md             # agent orientation skill
├── tests/                         # vitest suite
├── .claude-plugin/
│   ├── plugin.json                # Claude Code plugin manifest
│   └── marketplace.json           # Claude Code marketplace manifest
├── .codex-plugin/plugin.json      # Codex plugin manifest
├── .cursor-plugin/plugin.json     # Cursor Marketplace manifest
├── .mcp.json                      # MCP config (Claude Code auto-discovery)
├── mcp.json                       # Open Plugins standard manifest
└── assets/logo.svg                # CometChat logo

Configuration

Deployment

See DEPLOY.md for container build, environment, and platform notes.

Marketplaces

The same server URL is listed in these registries and directories:

Support

• Issues / feedback: open an issue in this repo.

• CometChat support: support@cometchat.com.

• Live MCP status: curl https://mcp.cometchat.com/health returns {"status":"ok"} when healthy.

Account tools (sign-in)

https://mcp.cometchat.com/mcp also has tools for your CometChat account, after you sign in: list and create apps, read credentials, turn features on, manage users, groups, API keys and webhooks, delete users, groups, messages and other data, and check usage and moderation. It's off until CometChat enables it on the hosted server.

What it can and can't do. When you connect, the sign-in page lists what the tool will be able to do. It can delete users, groups, messages, API keys, webhooks, roles, moderation lists and rules, and push providers, always after your approval. It can't delete apps, change billing, transfer ownership or ban users. A read-only connection can still read your app credentials, including the Auth Key; other API key values are masked.

Unverified apps. Anyone can register a client with any name. If the address your browser returns to isn't a known AI tool (one running on your machine, claude.ai's connector callback, or a page on ChatGPT, Grok, Antigravity, Mistral Le Chat or Perplexity), the page marks it unverified and it only gets read-only access. A ChatGPT, Grok or Antigravity connection made before 0.2.1 still shows as unverified: remove it and add it again. The page shows the app's icon: ours for a known app (by where it returns to, not its name), otherwise the logo the app registered (never for an unverified app), otherwise the first letter of its name. The icon only helps you recognise the app; the name and the return address are what to check.

High-risk changes need your approval in the browser. Creating webhooks, API keys or login tokens, inviting team members, changing app settings, replacing the OpenAI key and every delete each give your AI tool a link. Open it in the browser where you connected your AI tool, check the exact details, and approve; you get a short code to give back to your AI tool. The code works once, for that exact change, for up to 10 minutes. This guards against text inside your app (a message, a user name) talking your AI tool into one of these changes. Only approve changes you asked for, and only sign in to CometChat from a link your own AI tool opened when you connected it. Secret values on the approval page show only their last 4 characters. If your AI tool can control your browser, it could also press Approve, so don't rely on approval in that setup. Other changes ask for your OK in the chat.

Disconnecting. Remove the CometChat connection in your AI tool (Claude Code: /mcp, pick it, Clear authentication). That stops that tool. A sign-in copied off your device keeps working until it expires (access tokens last 1 hour, a sign-in at most 7 days); changing your CometChat password cuts off every copy within an hour. Step-by-step help: https://mcp.cometchat.com/oauth/cometchat/disconnect.

For admins. There's no organisation-wide switch to block account sign-ins yet. To cut off a person's sign-ins straight away, contact CometChat support.

Contributing

PRs welcome — especially:

• New implementation bundles: add an entry to src/bundles/manifest.ts listing existing docs pages. If no page covers the scenario, write the page in cometchat/docs first; bundle content always comes from the docs.

• Tool improvements: docs tools stay read-only; account tools keep the sign-in, confirmation and approval rules in Account tools.

Out of scope:

• Account tools that delete apps, change billing, transfer ownership or ban users.

• Mixed read/write tools (each tool is either read-only or a write).

Privacy

Docs tools. Read-only, with no account, API key or authentication. It serves CometChat's public documentation and does not request, store or transmit your code, prompts or personal data.

Account tools. Only used if you sign in. It passes your requests to your CometChat account and returns the results to your AI tool, which can include your users' names, emails and message text (truncated). The server stores nothing: your sign-in lives in your AI tool, sealed so only this server can read it. For security it logs one audit line per account action: a pseudonymous id for you, the tool, the app id, the ids it acted on (never message text, names or secrets), and the outcome.

Both. Request metadata such as your IP address is processed for rate limiting and abuse prevention. Usage analytics (PostHog) receive the tool name, outcome, duration, a session id and a one-way fingerprint of your IP. They never receive tool arguments, results or account details.

For full details, see CometChat's privacy policy: cometchat.com/legal-privacy-policy.

License

Apache-2.0. See LICENSE.