← Back to Blog

2026-09-22 • Updated 2026-09-26 • 7 min read • Build

How to Build an MCP for Your Internal Knowledge Base

Put your HR and operations handbook on a private MCP server, give each teammate an access token, and check that strangers are refused.

To build an MCP server for your internal knowledge base, add your handbook or wiki export as a source, make the server private, and give each teammate an access token for their AI assistant. With Context MCP Studio this takes no code: you upload the files or connect a private repository, and anyone without a token is refused before they can see what the server even contains.

By the end of this guide you will have a private server holding your people and operations handbook, a token for each teammate, and a test showing that an employee gets the answer and a stranger gets nothing.

What makes an internal knowledge base different

It holds things you would never publish. A people and operations handbook says that contractors send invoices to ap@ while employees use the payroll portal, which laptop to request, and who approves a parental leave plan. None of that belongs on your website, so the server that holds it must answer only the people who work with you.

Private means the whole server, not just the answers. On a private MCP Studio server, every request needs an access token, including the first handshake and the request for the list of tools. Tool names and descriptions hint at what the content covers, so those are protected too.

Everyone who can reach the server can read every source on it. Put sources together only when the same audience may read all of them. A public help center and an internal handbook belong on two separate servers.

Which sources to add

An export of the handbook. Most wikis and document tools can export pages as PDF, Word, HTML, or markdown. Zip the exported files and upload the archive: a zip counts as one source and can hold up to 200 files. Each upload is limited to 4 MB. A Google Docs file on your disk is only a link, so download it as Word or PDF first. The upload guide lists every format.

A private GitHub repository, if your handbook lives in one. MCP Studio asks you to link GitHub, confirms you can read the repository, and locks the server private for as long as that source is connected.

The free tier includes two sources per server, so the handbook export and one more collection make a complete first server.

How to build the server

  1. Open the MCP Studio wizard. You do not write any code.
  2. Name it for the audience. People and ops handbook tells everyone what they are connecting to.
  3. Add the handbook. Choose Upload a file for an export, or paste the private repository URL. A server with an uploaded file starts out private.
  4. Choose tools for questions. ask_question, search_docs, and summarize_content are the recommended set for an internal knowledge base.
  5. Confirm the server is private at the review step, then deploy.

The MCP Studio wizard, showing a source added and ready to deploy

How to give your team access

Open the server from your dashboard and find the Access panel.

  1. Create a token for each person or machine. Tokens start with mcps_live_ and work for this one server only. A server can hold up to 10 active tokens.
  2. Copy each token when it appears. It is shown once. If someone loses it, revoke it and create a new one.
  3. Add the token to the assistant as an Authorization: Bearer header. In Codex, keep the token in an environment variable and put the variable's name in bearer_token_env_var, so the token stays out of the config file itself.

One token per person means you can revoke a single laptop without disrupting everyone else, and revocation takes effect on the next request. The exact configuration for Cursor, Claude Desktop, Windsurf, and VS Code is in the private servers guide, and Codex is covered in How to connect an MCP server to Codex.

How to check that it works

Ask an internal question with a token. Restart the assistant after adding the header, then ask "Where do contractors send invoices?" The reply should give the address from the handbook and cite the handbook page.

Try the same URL without a token. From a machine with no token configured, the server should refuse the connection entirely. That refusal is the feature doing its job.

Ask something the handbook does not cover. The server should say so rather than guess.

You: What is our public marketing tagline?

Assistant: Nothing in this server's content covers a marketing tagline. The closest material is the contractor invoice page, which is a different subject. You would need to add that document as a source.

How to keep it trustworthy

Replace the export when the handbook changes. Uploaded files are not kept after their text is extracted, so updating one means removing the source and uploading the new version. A private repository refreshes daily on its own.

Treat the request log like a support transcript. The request log, which shows the questions people asked, is part of the paid Core analytics tier. Those questions come from your colleagues, so decide who on your team should read them.

Keep tokens out of prompts and shared files. A token is a password for the server, so revoke it if it is ever pasted somewhere it should not be.

Frequently asked questions

Is my internal data private on an MCP Studio server?

A private server refuses every request that does not carry a valid access token, including the first connection and the tool list. Tokens belong to one server and are shown once. You can revoke any token instantly from the Access panel.

Can I upload our employee handbook as a PDF?

Yes. You can upload PDF, Word, PowerPoint, spreadsheet, markdown, and HTML files up to 4 MB each, or a zip of up to 200 files as a single source. A scanned PDF has no text to read, so export a text-based version instead.

How do I give my whole team access?

Create an access token for each person or machine in the server's Access panel, up to 10 per server. Each person adds their token to their AI assistant as a bearer token. Revoking one token leaves everyone else connected.

What happens if someone leaves the company?

Revoke their token in the Access panel. The next request using that token is refused, and everyone else keeps working with their own tokens.

Can I put the help center and the handbook on the same server?

It is safer to keep them apart. Anyone who can query a server can read every source on it, so combining public and internal content either exposes the handbook or locks customers out of the help center.

Build your internal knowledge base with MCP Studio

Upload your handbook export, deploy it as a private server, and issue a token to each teammate. The wizard takes about a minute and needs no code. Open MCP Studio and keep the server when an employee gets the invoice address and a request without a token is refused.

Where to go next