Grok Build will make you a private MCP in an afternoon. One URL. Bearer JWT. No OAuth. Grokbots can use this to run everything extremely simply.
What you ship:
• Streamable HTTP: POST / GET / DELETE on /api/mcp
• Auth: Authorization: Bearer <JWT> only
401 = mint a new token. Do not add Authenticate / OAuth / WWW-Authenticate — clients will wander off into a flow you do not have.
• Identity in the JWT (tenant + sub). Grants in the database, not in the token.
• Same URL for every seat. Different JWT per person.
Wire it to Grok Build or a Grok Bot:
1. Add MCP → HTTP / SSE (not stdio)
2. Paste the URL
3. Header: Authorization: Bearer <JWT>
4. Save. tools/list should come back.
That’s the whole client setup.
On the server, keep it small:
• Wrap the APIs your UI already has. No new business logic in the MCP layer.
• Reads are free. Writes use the same propose / approve grants as a human.
• Split draft vs post (two people, two JWTs). Never let one leaked token do both.
• Do not wrap anything that sends money.
• Fail closed: missing token → 401; abuse → 429; bad image never gets traffic until smoke is green.
If a tool does not exist yet, say so. Do not stub it. Computer login is not a substitute for Bearer.
You do not need an IdP, OAuth discovery, or a special bot SDK. A JWT, a JSON-RPC handler, and the tools you already run in the product.