MCP connectors
Connect tools from compatible MCP Streamable HTTP servers, scoped to your workspace.
An MCP connector attaches an external MCP
server using Streamable HTTP to your tenant. Stdio servers and legacy
SSE-only endpoints are not supported. Its tools become callable from your graphs as
mcp.<alias>.<tool> — the model sees each tool's real schema, and the call
executes against the live server with its credentials held server-side.
Connectors are managed on the dashboard's Connections page (or the
/v1/mcp-servers API), per tenant.
Connecting a server
- Add — give it an alias (a slug:
mcp.github, the alias is the tool prefix) and the server's URL. The URL is validated against the egress guard at write time. - Probe — Inlay handshakes and answers one question: does this server require auth?
- Auth with one of the options below.
- Connect — the first connect discovers the server's tools and allowlists all of them. Narrow the allowlist on the card afterwards ("N of M allowed") if the agent should only see some.
| Auth option | What it needs |
|---|---|
| None | An open server; nothing to store. |
| Static token | A bearer token or API-key headers, written to the vault and referenced by name. The material is write-only from there. |
| OAuth | "Sign in with OAuth" handles discovery, dynamic registration when needed, and PKCE, then returns to the connector card. Tokens live in the vault; refresh is shared safely across replicas. |
The card shows status (connected, pending_auth, auth_expired,
unreachable, disabled), and disconnecting revokes the grant at the
provider (best-effort), deletes the connector, and removes its vaulted
credentials — in that order.
Calling the tools
In a graph, attach mcp.<alias>.<tool> to a node's tools like any other
tool. The build reads the connector's confirmed tool snapshot, so a typo'd
tool name fails the build, not the run. At dispatch the tool must be in
both the allowlist and the snapshot — a de-allowlisted tool is refused
even if the server still offers it.
Per-attachment config in tool_configs:
{ "mcp.github.create_issue": { "timeout_ms": 45000, "wire_verbosity": "redacted" } }timeout_ms (1s–120s, default 30s) bounds each call; wire_verbosity is
redacted by default — the redaction contract applies,
and "full" opts into full args/result on the wire for connectors you trust.
An OAuth connector whose token dies mid-run refreshes and retries once; if
that fails the connector flips to auth_expired and the tool error tells the
model to say so.
Drift
Servers change their tool lists. Refresh is pull-based and explicit — nothing polls in the background:
- Refresh on a connector diffs the live
tools/listagainst the confirmed snapshot:added,removed,changed(description or schema). - The diff dialog previews it; applying records the new snapshot and your picked allowlist, with new tools defaulting to OFF — a server cannot grant your agents new abilities on its own.
- A removed tool disappears from the build-time resolver, so a graph still referencing it fails its next build with unknown-tool. Loud at build, never a surprise mid-run.
Honest limits
- Streamable HTTP transport only — no stdio or legacy SSE-only hosting, and Inlay does not act as an MCP server itself.
- Elicitation (a server asking the user mid-call) is auto-declined.
- Calls meter as
Callunits. Metering units do not define commercial pricing; confirm applicable terms during onboarding. - Private-network servers (RFC1918) are refused by default; an operator can
opt a connector in explicitly (the
INLAY_MCP_ALLOW_PRIVATE_NETWORKSdeployment flag lifts it everywhere).url.fetchnever gets this exception.
Next
Secrets — the vault behind connector credentials.