MCP servers
Configure a server, its credentials, and its OAuth connection.
Settings > MCP Servers is where you connect external services as tool providers for your workspace's roles.
Add a server
Click Add Tools. If the server supports OAuth, choose an Authentication method:
| Method | Meaning |
|---|---|
| OAuth sign-in | Each member connects their own account before using the server. |
| Config credentials | You authenticate once, with a token or header, for the whole workspace. |
Server list
Each server shows its Name & Description, Status, Transport, and tool count. A disabled server carries a Disabled badge.
Server details
Click a server to open its detail panel:
| Field | Notes |
|---|---|
| Name, Description | Editable, saved as you leave the field. |
| Transport | Read-only. |
| Enabled | Toggle. See below. |
| Runs on | Read-only. Assigned automatically to the workspace's runtime, not chosen per server. |
| Configuration | The server's own fields (host, headers, and so on). |
| Status | Shows the last connection error, if any, with a Clear error action. |
| OAuth Integration | Admin-only. See below. |
| Your connection | Your own OAuth connection, if the server uses OAuth sign-in. See Personal integrations. |
Enable or disable a server
Toggle Enabled. A disabled server has no runtime assigned: its tools disappear from every role immediately, and the toggle explains this as "Out of service, tools hidden from agents."
Configure OAuth credentials
For a server configured with OAuth and manual client credentials (not dynamic client registration), click Configure credentials to open Configure OAuth:
| Field | Notes |
|---|---|
| Client ID | Prefilled with the stored value. |
| Client Secret | Write-only. Always starts blank; never returned by the API once saved. |
Auth URL, Token URL and Scopes are shown read-only for reference. Click Update Configuration to save.
Remove or duplicate a server
Delete removes the server; this cannot be undone. Copy duplicates its configuration, including its OAuth setup.
Re-registering a dynamically-registered server rotates its client credentials and disconnects every member currently connected to it. They must reconnect.
Security
- Configuration values and OAuth credentials are stored encrypted. The API never returns a saved secret.
- Only admins see decrypted configuration. Members, including those using a personal API key, get credential fields stripped from what they can read.