> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/armor/mcp-servers.md). # MCP Servers MCP (Model Context Protocol) servers extend the AI agent with external tool capabilities. Once an MCP server is registered in DuploCloud AI Suite, agents can call its tools from any ticket that includes the server's scope. Setting one up takes two stages: 1. **Register the MCP server** under **AI Admin → MCP Servers** — its endpoint and transport, or a raw JSON config. 2. **Create a Provider, credential, and Scope** that bind the server to a set of credentials. The Scope is what you attach to a ticket. *** ## Stage 1 — Register the MCP server Navigate to **AI Admin → MCP Servers**. The page lists every registered server as a card showing its transport and endpoint, with search, a provider-type filter, and sorting. ![MCP Servers list](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-c86fd1a31fdf9b91d1790da28456bb5828928cd1%2Fmcp-server-v2-step-01-mcp-servers-list.png?alt=media) Click **+ Add MCP Server**. The form opens in two sections — **Basic** and **Metadata** — tracked in the rail on the right. ![Add MCP Server, empty](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-8fbd1739a8177b67e398bb75e1cf8238a79f067f%2Fmcp-server-v2-step-02-add-server-empty.png?alt=media) Fill in the **Basic** section: * **Name** — a display name for the server * **Description** *(optional)* * **Provider Type** *(optional)* — links the server to a provider category for organizational purposes * **Config Type** — **HTTP/SSE** for a standard remote endpoint, or **Raw** to supply a full JSON config * **API Endpoint** — the MCP server's HTTP endpoint URL * **Transport** — `http` for standard HTTP, or `sse` for Server-Sent Events ![Add MCP Server, filled in](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-5b47dd579cfbe6c3818e807c7cc6f3a36671f66d%2Fmcp-server-v2-step-03-add-server-filled.png?alt=media) Click **Next** for the optional **Metadata** section, where you can attach arbitrary key/value pairs to the server. ![Metadata section](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-cfb5ce69b567c2f5fe00d83f9e1d7f6798e573bd%2Fmcp-server-v2-step-04-add-server-metadata.png?alt=media) Click **Create**. The new server appears in the list and is available to be linked to a Scope. ![Server created](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-990530841045acc7c0257ecdf566973d3163734a%2Fmcp-server-v2-step-05-server-created.png?alt=media) ### Using a raw JSON config instead Selecting **Config Type → Raw** replaces the endpoint and transport fields with a **Raw Config** editor, for servers that need a full configuration block rather than a single URL — for example a command-launched server. ![Config Type set to Raw](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-7afa3e79709e2e6349f98d7e48c4c7a8a39aa963%2Fmcp-server-v2-step-06-add-server-raw-config.png?alt=media) Raw configs support **credential placeholders**, so secrets and per-environment values are resolved at runtime rather than stored inline. Use `${credential.}` for any value that should come from the Scope's bound credentials: ```json { "mcpServers": { "grafana": { "command": "uvx", "args": ["mcp-grafana"], "env": { "GRAFANA_URL": "${credential.url}", "GRAFANA_SERVICE_ACCOUNT_TOKEN": "${credential.token}" } } } } ``` See [Credential Placeholders](/docs/armor/mcp-servers/credential-masking-for-mcp-servers.md) for the full reference. {% hint style="info" %} Placeholder keys are case-sensitive and must match the credential field names exactly — `${credential.token}` resolves a credential field named `token`, not `Token` or `TOKEN`. {% endhint %} *** ## Stage 2 — Create the Provider, credential, and Scope A **Provider** holds the credentials, and a **Scope** binds those credentials to the MCP server. Both are created in a single flow. Navigate to **AI Admin → Providers**, select the tab matching your server's category (for example **Other** for a generic tool, or **Observability** for Grafana), and click **+ Add Provider**. The page walks through three sections in order — **Provider Details**, **Credentials**, and **Scope** — shown in the rail on the right. ![Add Provider, Provider Details empty](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-4a6604cab8a90298b6ea7d7ba601e29285cf485d%2Fmcp-server-v2-step-07-provider-step1-empty.png?alt=media) ### Provider Details * **Name** — a name for this provider * **Description** *(optional)* * **Type** — the provider category * **Account ID** — an identifier for the provider account; any string works if it isn't needed for routing * **Metadata** *(optional)* — key/value pairs ![Provider Details filled in](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-a3eefeedf0802c317f2501cc2a34f1264c5205d4%2Fmcp-server-v2-step-08-provider-step1-filled.png?alt=media) Click **Next**. ### Credentials Give the credential set a **Name**. The fields below it depend on the provider **Type** you chose — an AWS provider asks for a credential type and access keys, a Kubernetes provider asks for a token or role, and a generic provider takes key/value pairs. ![Credentials section](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-6aa41d986e32c816a2d8f9eb52428c7d861e432e%2Fmcp-server-v2-step-09-provider-step2-credentials.png?alt=media) For a raw-config MCP server, add one credential field per `${credential.*}` placeholder used in the config, matching the placeholder keys exactly. ![Credentials filled in](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-c11f16270610df2d451afa4407682d708fb00d76%2Fmcp-server-v2-step-10-provider-step2-filled.png?alt=media) Click **Next**. You can also **Skip** this section and add credentials later from the provider's detail page. ### Scope The Scope is what ties everything together and what you select when creating a ticket. * **Name** — the scope name shown in the ticket form * **Description** *(optional)* * **MCP Server** — select the server registered in Stage 1 * **Resource Map** *(optional)* — **Key** plus one or more **Values**, passed to the agent as additional context ![Scope section](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-5ef31bbd4da5390d5e820c52e54d4b600eb0c831%2Fmcp-server-v2-step-11-provider-step3-scope.png?alt=media) The credential created in the previous section is carried forward automatically and shown read-only. ![Scope filled in](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-49500c01c8e57a4c60de7b562b881cd25bae8262%2Fmcp-server-v2-step-12-provider-step3-filled.png?alt=media) Click **Create**. A confirmation appears, followed by an **Attach Scope to Workspaces** prompt — select the workspaces that should have access to this scope, or **Skip** to attach them later. ![Provider created, attach scope to workspaces](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-86d4551874898fc59838053035d1bfcd1e756262%2Fmcp-server-v2-step-13-provider-created.png?alt=media) *** ## Using the MCP server from a ticket With the Scope configured, create a ticket and select that scope. The agent then has access to the server's tools for the life of that ticket, using the credentials bound to the scope — tools are named `mcp____`. For a raw-config server, the platform resolves every `${credential.*}` placeholder from the bound credentials before the session starts, writes the resolved `.mcp.json` for the agent, and the agent calls the server's tools transparently. Secrets are never written into the stored config. ### Controlling which tools the agent may call By default the agent asks before running any MCP tool. Each ticket's **Details** panel has an **MCP Tool Permissions** entry for changing that. ![MCP Tool Permissions in the ticket Details panel](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-e1767f7d63b4e28a0b6f0e844bb9bfb7f08858a1%2Fmcp-tool-permissions-step-06-details-mcp-entry.png?alt=media) It opens the **MCP Tool Approval Settings** dialog: ![MCP Tool Approval Settings](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-8dc891b07ab2d93ddb8952631dbc28f914a11787%2Fmcp-tool-permissions-step-07-mcp-modal-default.png?alt=media) * **Approve All** / **Reject All** — blanket rules for every tool on every server * **Auto-approve these MCP servers** — every tool on a selected server runs without asking * **Auto-reject these MCP servers** — every tool on a selected server is refused without asking The server pickers list only the servers reachable from that ticket's scopes. ![Selecting a server to auto-approve](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-a9f087dc8734aeb6b9153db39ede990279173ade%2Fmcp-tool-permissions-step-08-approve-picker-open.png?alt=media) For anything narrower than a whole server, expand **Advanced — edit raw patterns**. Patterns are regular expressions matched end to end against the full tool name, which always looks like `mcp____`; the `mcp__` prefix is required. ![Advanced raw patterns](https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fgit-blob-45137b146c7f0f73a74172c2471273051c652d0d%2Fmcp-tool-permissions-step-09-advanced-raw-patterns.png?alt=media) {% hint style="warning" %} Rejection wins over approval — if a tool is covered by both an approval and a rejection rule, it is rejected. {% endhint %} These settings apply to the one ticket, overriding the workspace defaults for that conversation only. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.duplocloud.com/docs/armor/mcp-servers.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.