Skip to main content
Users can connect Model Context Protocol servers to give the agent tools beyond its built-in workspace capabilities, such as issue trackers, internal APIs, or knowledge bases. MCP servers are configured per user under Settings → MCP. Administrators can manage each user’s servers under Admin → Users → Edit MCP servers in both editions.

​
Add a server

​
string
required
A label for the server, 1 to 80 characters.
​
string
required
The server endpoint. Subject to the same outbound guard as model providers: HTTPS and a public address unless ALLOW_PRIVATE_EGRESS or ALLOW_INSECURE_HTTP is enabled.
​
'http' | 'sse'
default:"http"
Streamable HTTP is the current standard. Use sse only for older servers.
​
object
Optional headers for authentication, encrypted with SETTINGS_ENCRYPTION_KEY.
​
boolean
default:"true"
Whether the server can be selected for use in conversations.
After saving, use Test connection to discover tools, then review them and choose Trust these tools to approve their definitions.

​
Edit a server

Click the pencil button on a server to load its saved name, URL, transport, enabled state, and all custom headers. Header values are masked initially; use Reveal to view them. You can edit values, add headers, or remove them all. For bearer authentication, use Authorization with a value of Bearer YOUR_TOKEN. Cancel discards changes; saving updates the existing server rather than adding a duplicate. Changing the URL, transport, or headers requires renewed trust.

​
Administrator-managed servers

In Admin → Users, turn off a user’s MCP settings or use Disable MCP settings for all users for all current non-admin accounts. This does not change provider settings or account access, and earlier bulk changes do not apply to newly created accounts. Administrators retain access. Restricted users can still view and use configured servers, but cannot add, edit, delete, test, trust, or read their saved headers. Use Edit MCP servers next to any user to configure and trust servers on their behalf. The admin API provides the same operations at /api/admin/mcp?userId=USER_ID, with /test and /trust endpoints.
The control plane connects to MCP servers, not the browser and not the workspace pod. Redirects are refused rather than followed, which prevents a server from redirecting the connection to an internal address.

​
Interactive MCP Apps

Some MCP tools also provide an interactive interface inside chat. This requires an operator-configured sandbox on a separate registrable domain; adding an MCP server alone does not enable it. See MCP Apps for setup, verification, and troubleshooting. Ordinary MCP tools do not require this sandbox. Browser MCP’s dashboard watch link works independently of inline sandbox configuration. browser_watch is model-visible; browser_watch_ticket and browser_session_end remain app-only and are not offered to the model.

​
Trust and tool drift

An MCP server can change its tool definitions at any time. Because tool descriptions are instructions to the model, a changed description is a way to influence the agent’s behavior after you approved it. This attack is often called tool poisoning or a rug pull. r5d.chat fingerprints tool definitions when you approve a server and compares them on later connections.
1

Review on first connection

The discovered tools and their descriptions are shown before the server is usable.
2

Trust the current definitions

Approving records a fingerprint of exactly those definitions.
3

Drift is detected automatically

If the definitions change later, the change is surfaced instead of being applied silently.
4

Re-approve deliberately

Review the new definitions and approve them explicitly to resume use.
Only connect MCP servers you control or trust. A malicious server can attempt to steer the agent into exfiltrating workspace file contents through its own tool calls. Tool descriptions are model instructions, so treat adding a server like installing a plugin with access to your files.

​
Operational guidance

Give each MCP server a token with the minimum scope it needs. Header values are available to users with MCP edit access and to administrators, so a broad token is a broad exposure.
Select at most 8 MCP servers per chat. All model-visible tools from the selected, enabled, trusted servers are passed to the model; app-only tools are excluded. There is no 40-tool per-server truncation: tools are not silently discarded to fit a budget. Provider tool-count and context limits still apply, and large tool sets can degrade model tool selection. If a provider rejects a request, reduce the selected servers or the tools exposed by those servers.
Tool discovery happens per connection. A slow or unreachable server delays runs that would otherwise succeed, so remove dead servers promptly.

​
Troubleshooting

The outbound guard blocks private destinations by default. Set ALLOW_PRIVATE_EGRESS=true if the server genuinely lives inside your network, and constrain the control plane with NetworkPolicy.
The endpoint may be a base URL rather than the MCP endpoint, or the transport may be wrong. Try the alternate transport and confirm the exact path with the server’s documentation.
That is drift detection working. Review the new tool definitions before re-approving; an unexplained description change deserves scrutiny.