Skip to Content
How-to guidesHow-to guidesAdd an MCP server

Add an MCP server

A remote MCP server can be governed just like any other platform. Once you add it, its tools become grantable scopes, and your agents reach it only through AgentValet. For the concepts behind this, see MCP servers as platforms.

Open the Add-server dialog

Go to Platforms → Connections in the sidebar. At the top right, click + Add MCP server. A dialog titled Add MCP server opens.

You will see two tabs: Paste config and Manual.

For an OAuth-protected server, use the Manual tab. The paste-config tab does not detect OAuth and will send you down the static-secret path instead.

Enter the server

On the Manual tab, fill in:

  • MCP server URL (for example https://mcp.example.com/mcp)
  • Display name (optional)

Click Continue. AgentValet probes the server to discover how it authenticates.

Choose a sign-in method (OAuth servers)

If the server advertises OAuth, the dialog asks How do you want to sign in to this server? with two options:

  • Sign in with OAuth (recommended) — approve on the provider’s screen. No key to paste.
  • Use an API key — paste a token you already hold. Some servers accept both.

If the server doesn’t advertise OAuth, this step is skipped and you go straight to the static-secret step below. You can go back with ← Change sign-in method.

If you sign in with OAuth

The connection is stored for your whole workspace — not for one agent.

  1. Under Grant to an agent (optional), either leave Don’t grant yet — I’ll do it on the Agents page or pick an active agent. Picking one grants it this server’s tools as soon as the connection completes, with three options for that grant:
    • Include destructive tools — off by default, so tools like delete, merge and unshare are withheld (you can still grant them later on the agent’s page).
    • Require my approval for each call.
    • Grant expires — Never, In 24 hours, In 7 days, or In 30 days.
  2. If the server lists Authorization scopes, untick anything it should not be able to do (all are ticked by default; the provider decides what it finally grants).
  3. Click Authorize. Your browser is sent to the provider’s own consent screen. Approve there and you are returned to the Platforms page.

On a successful return you will see the toast “MCP server connected. Grant its tools to the agent from its detail page.” (or, if you granted to an agent and destructive tools were withheld, a toast saying how many were not granted). The token is stored in the vault at workspace level; agents never see it.

A few honest limitations:

  • OAuth works only for servers that support automatic client registration. A server without it returns “This server doesn’t support automatic OAuth registration.”
  • The optional display name is usually not kept on the OAuth path; the server’s host is used as the name.
  • Demo workspaces cannot connect external servers, and the connection counts against your plan’s platform limit.

If the server uses a static secret

When the server doesn’t use OAuth (or you chose Use an API key, or used the paste-config tab), the dialog shows an Authentication selector — None, Bearer token, Custom header, or API key in URL query — and a field for the secret. Click Test connection: AgentValet lists the tools it discovered, or tells you the test failed. Click Connect (or Connect anyway after a failed test). On success you see ”✓ Connected — N tools available” and a Done button. Any secret you enter is encrypted in the vault; agents never see it.

Grant the tools to an agent

Unless you picked an agent during OAuth sign-in, adding the server does not grant anything on its own. Open the agent’s detail page and grant the specific tools (scopes) you want it to use. See Configure an agent’s permissions.

If an agent that is granted on an OAuth MCP server tries to use it before anyone has authorized AgentValet with that server, the call is refused with needs_consent, an access request is raised, and the link to finish it lands in three places: the agent’s own result (so the person in the conversation can open it), the admins’ notifications, and the admins’ email.

  1. Open the link (app.agentvalet.ai/connect?token=...), or find the request under Notifications.
  2. The page names the agent, the server and its URL. Click Authorize. Your browser is sent to the server’s own consent screen.
  3. When it returns, the page confirms the server is authorized and the request is closed. The agent’s held call resumes on its own where the client supports it; otherwise ask the agent to try again.

Authorizing AgentValet with an OAuth server is an admin action. A member who opens the link is told an admin has been notified. The token is stored for the workspace; the agent never sees it, and it can still do nothing beyond what it was granted.

Agents see this state before they call: list_platforms marks such a server with needsConsent: true, so a well-behaved agent asks for the authorization first instead of finding out by failing.

Next

Last updated on
Connect a platformUse a GitHub App bot identity