Build Your Own Custom MCP Server in 2026: FastMCP, Streamable HTTP, OAuth End-to-End

TL;DR — Build your first MCP server in under 30 minutes. FastMCP for Python, @modelcontextprotocol/sdk for TypeScript. Start with stdio + a single tool, graduate to streamable HTTP + OAuth 2.1 with PKCE when you need to ship to other people.

What the MCP server does

Your custom MCP exposes whatever you want to your agent — a CRM lookup, a domain-specific calculator, a vector search over your docs. The protocol is JSON-RPC 2.0 with three concepts: tools (functions the agent can call), resources (read-only data), and prompts (reusable templates). You implement; the SDK handles the wire.

flowchart LR
 A[Agent] -->|JSON-RPC tools/list| B[Your MCP]
 B -->|tool definitions| A
 A -->|tools/call| B
 B -->|your code| C[Backend]
 C -->|result| B
 B -->|tool result| A

Auth + transport (sse/stdio/http)

Stdio for local dev (zero auth, child-process boundary). Streamable HTTP for production (OAuth 2.1 + PKCE, RFC 8414 for server discovery, RFC 9728 for protected-resource metadata). The 2025-11-25 spec deprecates plain HTTP+SSE — Streamable HTTP is the only HTTP transport you should ship in 2026.

How CallSphere uses it

We've shipped about a dozen custom MCP servers internally. Two examples:

• callsphere-leads-mcp — fronts our 115+ table lead database with read-only tools (search_leads, get_lead_by_phone, unified_pipeline_summary). Used by ops agents.
• callsphere-voice-eval-mcp — exposes voice-agent eval results as tools (get_eval_run, list_failures_last_7d). Used by our AI Engineer skill to triage regressions.

Each is FastMCP, ~200 lines of Python, deployed to ECS Fargate behind WorkOS OAuth. Total time from idea to first tool call: ~2 hours.

Build / install

1. Pick a stack. Python: pip install fastmcp. TypeScript: npm i @modelcontextprotocol/sdk.
2. Define one tool. FastMCP example below — three lines for a tool definition.
3. Run stdio first: python my_mcp.py. Use the MCP Inspector (npx @modelcontextprotocol/inspector) to test.
4. Register with Claude Desktop / Cursor / your client. Verify the tool appears.
5. When ready for remote: switch transport to streamable HTTP. FastMCP makes this a one-line change.
6. Add OAuth 2.1 + PKCE. The well-known endpoints are /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.
7. Add audit logging on every tool call. You'll thank yourself.
8. Publish to the official registry (registry.modelcontextprotocol.io) if it's public.

# my_mcp.py — minimal FastMCP server
from fastmcp import FastMCP

mcp = FastMCP("callsphere-leads")

@mcp.tool()
def get_lead_by_phone(phone: str) -> dict:
 """Look up a CallSphere lead by E.164 phone number."""
 #...your DB query
 return {"id": 42, "stage": "trial", "plan": "Orchestrate"}

if __name__ == "__main__":
 mcp.run() # stdio by default

FAQ

Python or TypeScript? Python with FastMCP for fastest iteration. TypeScript when your stack is already Node.

stdio vs streamable HTTP? stdio = local + zero auth + dev. Streamable HTTP = remote + OAuth + prod.

Do I need to publish? Only if it's public. Internal MCPs stay internal.

Inspector or test client? MCP Inspector is the official one — npx @modelcontextprotocol/inspector. Use it.

Explore a live demo and compare current plans to find the right fit for your business.

Sources

• Build an MCP Server (modelcontextprotocol.io)
• FastMCP Quickstart
• Build Your First MCP Server (DEV)
• MCP Developer Guide 2026 (Particula)
• TypeScript SDK Handbook (freeCodeCamp)

Build Your Own Custom MCP Server in 2026: FastMCP, Streamable HTTP, OAuth End-to-End: production view

Build Your Own Custom MCP Server in 2026: FastMCP, Streamable HTTP, OAuth End-to-End usually starts as an architecture diagram, then collides with reality the first week of pilot. You discover that vector store choice (ChromaDB vs. Postgres pgvector vs. managed) is not really a vector store choice — it's a latency, freshness, and ops choice. Picking wrong forces a re-platform six months in, exactly when you have customers depending on it.

Shipping the agent to production

Production AI agents live or die on three loops: evals, retries, and handoff state. CallSphere runs 37 agents across 6 verticals, each with its own eval suite — synthetic call transcripts replayed nightly with assertion checks on extracted entities (date, time, party size, insurance, address). Without that loop, prompt regressions ship silently and you only find out when bookings drop.

Structured tools beat free-form text every time. Our 90+ function tools all enforce JSON schemas validated server-side; if the model hallucinates an integer where a string is required, we retry with a corrective system message before falling back to a deterministic path. For long-running flows, we treat agent handoffs as a state machine — booking → confirmation → SMS — so context survives turn boundaries.

The Realtime API vs. async decision usually comes down to "is the user holding the phone right now?" If yes, Realtime; if no (callback queue, after-hours voicemail), async wins on cost-per-conversation, which we track per agent in 115+ database tables spanning all 6 verticals.

FAQ

Is this realistic for a small business, or is it enterprise-only? The healthcare stack is a concrete example: FastAPI + OpenAI Realtime API + NestJS + Prisma + Postgres healthcare_voice schema + Twilio voice + AWS SES + JWT auth, all HIPAA aligned. For a topic like "Build Your Own Custom MCP Server in 2026: FastMCP, Streamable HTTP, OAuth End-to-End", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations.

Which integrations have to be in place before launch? Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar.

How do we measure whether it's actually working? The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer.

Talk to us

Explore a live demo and compare current plans to find the right fit for your business.