diff --git a/README.md b/README.md
index 395653d..e6821e7 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # MCP Email Server
 
-A Dockerized, OpenAPI-based MCP email assistant for law firms and legal teams.
+A Dockerized MCP (Model Context Protocol) email assistant for law firms and legal teams.
 
 Integrates:
 - IMAP/SMTP email operations
@@ -10,7 +10,7 @@ Integrates:
 - CalDAV/CardDAV (e.g., Nextcloud) for calendar and contacts
 - Triage guidance using personnel/chain-of-command
 
-Designed to be consumed by LLMs via OpenAPI tool servers (e.g., Open WebUI).
+Designed to be consumed by LLMs via MCP (Streamable HTTP) in Open WebUI.
 
 ## Quick start
 
@@ -22,6 +22,8 @@ Designed to be consumed by LLMs via OpenAPI tool servers (e.g., Open WebUI).
 
    docker run -d \
      -p 8000:8000 \
+     -e API_KEY="your_api_key_here" \
+     -e LOG_LEVEL="DEBUG" \
      -e IMAP_HOST=imap.example.com \
      -e IMAP_PORT=993 \
      -e IMAP_USE_SSL=true \
@@ -39,19 +41,39 @@ Designed to be consumed by LLMs via OpenAPI tool servers (e.g., Open WebUI).
      -e PERSONNEL_JSON='[{"name":"Jane Doe","role":"Managing Partner","email":"jane@example.com","escalates_to":null},{"name":"John Smith","role":"Associate","email":"john@example.com","escalates_to":"Jane Doe"}]' \
      mcp-email-server
 
-3. OpenAPI spec:
+3. Health check:
 
-   http://localhost:8000/openapi.json
+   http://localhost:8000/health
 
-4. Integrate with Open WebUI (OpenAPI tool server):
+4. MCP endpoint:
+
+   - POST http://localhost:8000/mcp
+   - Uses JSON-RPC 2.0 (methods: initialize, tools/list, tools/call)
+
+5. Integrate with Open WebUI (MCP Streamable HTTP):
 
    - Admin Settings → External Tools → Add Server
-   - Type: OpenAPI
-   - URL: http://<your-server>:8000/openapi.json
+   - Type: MCP (Streamable HTTP)
+   - Server URL: http://<your-server>:8000/mcp
+   - Auth: Bearer
+   - Key: your_api_key_here
+   - Save, then enable tools in a chat.
 
 ## Environment variables
 
-Required for email:
+See env.example for a full list.
+
+Core:
+
+- API_KEY:
+  - If set, all /mcp requests must include:
+    Authorization: Bearer <API_KEY>
+  - Leave empty to disable auth (not recommended in production).
+
+- LOG_LEVEL:
+  - e.g., INFO, DEBUG, ERROR (default: INFO)
+
+IMAP (incoming mail):
 
 - IMAP_HOST
 - IMAP_PORT
@@ -59,6 +81,8 @@ Required for email:
 - IMAP_USERNAME
 - IMAP_PASSWORD
 
+SMTP (outgoing mail):
+
 - SMTP_HOST
 - SMTP_PORT
 - SMTP_USE_TLS
@@ -97,59 +121,58 @@ CalDAV/CardDAV (e.g., Nextcloud):
 - DAV_PASSWORD
 - DAV_VERIFY_TLS: true/false (default: true)
 
-Logging:
+## MCP tools
 
-- LOG_LEVEL: e.g., INFO, DEBUG, ERROR (default: INFO)
-
-## Tools (OpenAPI endpoints)
-
-All endpoints are POST and return JSON.
+All tools are exposed via MCP (Streamable HTTP) at POST /mcp.
 
 Email:
 
-- /list_folders
-- /search_messages
-- /get_new_messages
-- /sync_seen
-- /mark_as_read
-- /flag_message
-- /move_message
-- /copy_message
-- /apply_label
-- /remove_label
-- /list_labels
-- /get_unread_summary
-- /send_email
-- /reply_to_message
-- /forward_message
-- /save_draft
-- /list_attachments
-- /download_attachment
-- /search_attachments
-- /schedule_send
-- /export_conversation
-- /conflict_check_search
-- /get_triage_config
+- list_folders
+- search_messages
+- get_new_messages
+- sync_seen
+- mark_as_read
+- flag_message
+- move_message
+- copy_message
+- apply_label
+- remove_label
+- list_labels
+- get_unread_summary
+- send_email
+- reply_to_message
+- forward_message
+- save_draft
+- list_attachments
+- download_attachment
+- search_attachments
+- schedule_send
+- export_conversation
+- conflict_check_search
+- get_triage_config
 
 Contacts (CardDAV):
 
-- /list_carddav_addressbooks
-- /search_carddav_contacts
-- /get_carddav_contact
-- /create_carddav_contact
-- /update_carddav_contact
-- /delete_carddav_contact
+- list_carddav_addressbooks
+- search_carddav_contacts
+- get_carddav_contact
+- create_carddav_contact
+- update_carddav_contact
+- delete_carddav_contact
 
 Calendar (CalDAV):
 
-- /list_caldav_calendars
-- /search_caldav_events
-- /create_caldav_event
-- /update_caldav_event
-- /delete_caldav_event
+- list_caldav_calendars
+- search_caldav_events
+- create_caldav_event
+- update_caldav_event
+- delete_caldav_event
 
 ## Notes
 
 - IMAP operations use UIDs for stability.
 - Conflict check search scans subject lines across specified folders for given terms.
 - New-message tracking is in-memory per container instance.
+- For production:
+  - Always set API_KEY.
+  - Use HTTPS and secure IMAP/SMTP settings.
diff --git a/env.example b/env.example
index eb6e081..b6a0afd 100644
--- a/env.example
+++ b/env.example
@@ -1,6 +1,7 @@
 # MCP Email Server - Docker Environment Variables
 
 # MCP API key (Bearer auth for /mcp endpoints)
+# If set, all /mcp requests must include: Authorization: Bearer <API_KEY>
 API_KEY=
 
 # Logging