Connect MCP Servers

A hosted Model Context Protocol (MCP) server exposes tools your application can call. Connect manages its account authorization; your app still chooses which tools to expose and when to require approval.

This guide assumes Connect is configured. Choose a server-by-URL flow when the server supports registration, or reuse an existing provider grant when it requires a pre-registered client.

Connect a Server by URL

With connect.mcp: true, users can connect a hosted MCP server by URL. Connect discovers its authorization server, runs authorization with PKCE, and can avoid manual OAuth app registration when the server supports client metadata documents or dynamic client registration.

Client metadata documents require a public HTTPS application origin. Local development needs dynamic registration when its origin cannot be fetched by the authorization server. If neither mechanism is supported, Connect reports that the server needs a pre-registered client. Users still grant account access.

Store an API Key

For pasted API keys, your application verifies the key and saves it through connect.saveApiKey(...); Connect encrypts it and enforces connection access.

Reuse an Existing Account Grant

For a server that requires a pre-registered OAuth client, Connect can reuse a provider's existing account grant. For example, Google's Calendar server uses the Google client credentials configured by cloudconfig connect add google.

Declare its endpoint in that provider's mcpServers:

connect: {
  providers: {
    google: {
      scopes: ['https://www.googleapis.com/auth/calendar.events'],
      mcpServers: ['https://calendarmcp.googleapis.com/mcp/v1'],
    },
  },
}

Connect the account through the Google provider, then call connect.mcp(actor, googleConnectionId, { server }) on the server. This reuses the same ownership checks, token storage, and refreshes. Only exact endpoints declared for that provider can receive its tokens. An optional signal cancels MCP requests with the enclosing job or request.

This avoids a second OAuth flow; it does not remove the vendor's app setup, required scopes, or service configuration. Follow Google's MCP setup before offering those tools.