Skip to main content

​
MCP Server

The MCP Server integration lets you plug any Model Context Protocol (MCP) server you host or trust into an agent by supplying its URL. Unlike the built-in integrations — which Cobalt builds and maintains for a specific vendor — this one is generic: Cobalt connects to the server you name, discovers the tools and resources it exposes, and makes them available to your agent inside the same allowlist, confirmation, and audit guardrails every integration gets. Use it to bring your own internal services, a partner’s MCP endpoint, or any off-the-shelf MCP server into an agent without Cobalt building a dedicated connector first.

​
How it’s different

There’s no fixed list of tools on this page, because the tools come from your server. When you connect (and whenever you ask Cobalt to refresh), Cobalt calls the server’s tools/list and resources/list and materializes:
  • Tools — each capability the server advertises, with its name and description, which you then review and enable per agent.
  • Resources — if the server exposes MCP Resources, Cobalt adds two tools, List resources and Read resource, so resource content flows through the same governance as everything else.
As with every integration, the discovered tools start governed by Cobalt’s allowlist and audit substrate — you choose which ones the agent may actually use.

​
Set it up

1

Add the integration

From your agent, open Integrations and choose MCP Server.
2

Enter the server URL

Paste your MCP server URL. It must be HTTPS (plain HTTP is allowed only for localhost) and reachable from the public internet — Cobalt connects to it on every turn that uses the integration.
3

Choose how end-users authenticate

Pick one of three modes:
  • None — no credentials are sent. Enabling the integration is the authorization; there’s no per-user sign-in.
  • Static bearer token — you provide one credential that covers all of the agent’s users. They’re never prompted. Paste the bearer token (stored encrypted; rotate it later on the detail page).
  • Per-user OAuth (recommended) — each user authorizes their own access the first time they use it. Cobalt registers itself as an OAuth client with the server’s authorization server automatically (Dynamic Client Registration), so there’s nothing to register by hand.
4

Save and let Cobalt discover the tools

On save, Cobalt connects to the server and discovers its tools and resources. Review the discovered tools, enable the ones you want the agent to use, name the integration, and save.
5

Refresh when the server changes

If you add or change tools on your server, use the refresh tools action on the integration’s detail page to re-discover them. Cobalt updates the available tools and flags anything new for you to enable.

​
Troubleshooting

The URL must be HTTPS and publicly reachable. Cobalt connects from its own infrastructure, not from your browser, so a server that’s only reachable on your corporate network or behind a VPN won’t connect. (Plain HTTP is permitted only for localhost during local testing.)
  • No tools appear after connecting. The server returned an empty tools/list, or Cobalt couldn’t reach it. Confirm the URL is correct and the server is up, then use refresh tools.
  • Users are repeatedly asked to authorize. In Per-user OAuth mode each user signs in once; if they’re prompted every time, the server’s authorization server may not support Dynamic Client Registration, or its tokens are short-lived. A Static bearer token avoids per-user sign-in entirely.
  • A tool the server has isn’t available to the agent. Discovered tools are off until you enable them — review the tool list on the integration and switch on the ones you want.

​
FAQ

Any server that speaks the Model Context Protocol over streamable HTTP — one you host yourself, a partner’s, or an off-the-shelf MCP server — as long as its URL is HTTPS and reachable from the public internet.
No. In Per-user OAuth mode Cobalt registers itself as a client with your server’s authorization server automatically (Dynamic Client Registration). In Static bearer token mode you paste one token; in None mode there are no credentials at all.
Yes. If your server exposes Resources, Cobalt adds List resources and Read resource tools so resource content runs through the same allowlist and audit controls as tools.
Use Per-user OAuth when each person should reach the server with their own identity and permissions (recommended). Use a Static bearer token for a shared service credential. Use None for a server that needs no authentication.