> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server

> Connect any MCP-compliant server you host or trust by URL, and Cobalt discovers its tools and resources for your agent to use.

# MCP Server

The **MCP Server** integration lets you plug **any [Model Context Protocol](https://modelcontextprotocol.io)
(MCP) server** you host or trust into an agent by supplying its URL. Unlike the
built-in integrations — which Cobalt builds and maintains for a specific vendor —
this one is **generic**: Cobalt connects to the server you name, **discovers the
tools and resources it exposes**, and makes them available to your agent inside the
same allowlist, confirmation, and audit guardrails every integration gets.

Use it to bring your own internal services, a partner's MCP endpoint, or any
off-the-shelf MCP server into an agent without Cobalt building a dedicated
connector first.

## How it's different

There's no fixed list of tools on this page, because the tools come from **your**
server. When you connect (and whenever you ask Cobalt to refresh), Cobalt calls the
server's `tools/list` and `resources/list` and materializes:

* **Tools** — each capability the server advertises, with its name and description,
  which you then review and enable per agent.
* **Resources** — if the server exposes MCP Resources, Cobalt adds two tools,
  **List resources** and **Read resource**, so resource content flows through the
  same governance as everything else.

As with every integration, the discovered tools start governed by Cobalt's
allowlist and audit substrate — you choose which ones the agent may actually use.

## Set it up

<Steps>
  <Step title="Add the integration">
    From your agent, open **Integrations** and choose **MCP Server**.
  </Step>

  <Step title="Enter the server URL">
    Paste your **MCP server URL**. It must be **HTTPS** (plain HTTP is allowed only
    for `localhost`) and reachable from the public internet — Cobalt connects to it
    on every turn that uses the integration.
  </Step>

  <Step title="Choose how end-users authenticate">
    Pick one of three modes:

    * **None** — no credentials are sent. Enabling the integration *is* the
      authorization; there's no per-user sign-in.
    * **Static bearer token** — you provide one credential that covers all of the
      agent's users. They're never prompted. Paste the **bearer token** (stored
      encrypted; rotate it later on the detail page).
    * **Per-user OAuth (recommended)** — each user authorizes their own access the
      first time they use it. Cobalt registers itself as an OAuth client with the
      server's authorization server automatically (Dynamic Client Registration), so
      there's nothing to register by hand.
  </Step>

  <Step title="Save and let Cobalt discover the tools">
    On save, Cobalt connects to the server and discovers its tools and resources.
    Review the discovered tools, enable the ones you want the agent to use, name the
    integration, and save.
  </Step>

  <Step title="Refresh when the server changes">
    If you add or change tools on your server, use the **refresh tools** action on
    the integration's detail page to re-discover them. Cobalt updates the available
    tools and flags anything new for you to enable.
  </Step>
</Steps>

## Troubleshooting

<Warning>
  **The URL must be HTTPS and publicly reachable.** Cobalt connects from its own
  infrastructure, not from your browser, so a server that's only reachable on your
  corporate network or behind a VPN won't connect. (Plain HTTP is permitted only
  for `localhost` during local testing.)
</Warning>

* **No tools appear after connecting.** The server returned an empty `tools/list`,
  or Cobalt couldn't reach it. Confirm the URL is correct and the server is up, then
  use **refresh tools**.
* **Users are repeatedly asked to authorize.** In **Per-user OAuth** mode each user
  signs in once; if they're prompted every time, the server's authorization server
  may not support Dynamic Client Registration, or its tokens are short-lived. A
  **Static bearer token** avoids per-user sign-in entirely.
* **A tool the server has isn't available to the agent.** Discovered tools are off
  until you enable them — review the tool list on the integration and switch on the
  ones you want.

## FAQ

<AccordionGroup>
  <Accordion title="What kind of server can I connect?">
    Any server that speaks the Model Context Protocol over streamable HTTP — one you
    host yourself, a partner's, or an off-the-shelf MCP server — as long as its URL
    is HTTPS and reachable from the public internet.
  </Accordion>

  <Accordion title="Do I have to register an OAuth app?">
    No. In **Per-user OAuth** mode Cobalt registers itself as a client with your
    server's authorization server automatically (Dynamic Client Registration). In
    **Static bearer token** mode you paste one token; in **None** mode there are no
    credentials at all.
  </Accordion>

  <Accordion title="Are MCP Resources supported?">
    Yes. If your server exposes Resources, Cobalt adds **List resources** and **Read
    resource** tools so resource content runs through the same allowlist and audit
    controls as tools.
  </Accordion>

  <Accordion title="How do I pick an authentication mode?">
    Use **Per-user OAuth** when each person should reach the server with their own
    identity and permissions (recommended). Use a **Static bearer token** for a
    shared service credential. Use **None** for a server that needs no
    authentication.
  </Accordion>
</AccordionGroup>

## Related

* [Integrations overview](/integrations/overview) — how integrations work in
  general.
* [How Cobalt works](/concepts/how-cobalt-works) — where integrations fit.