Appearance

External MCP Integrations ​

WARNING

Not available in every project yet. If Integrations → MCP servers isn't in your project, this feature hasn't been enabled there yet. MCP Builder, the outbound counterpart, can be used to create and manage MCP profiles. Availability of published tools depends on your project.

External MCP is the inbound counterpart to MCP Builder: instead of your project exposing tools, it consumes tools from a third-party MCP server, so the Studio Copilot (and the in-Studio Playground) can call them.

What it does not do ​

This integration does not install or execute arbitrary code inside your pod. There's no support for npx, pip, shell commands, or customer-supplied container images. "Install MCP" in the UI means registering a secure remote connection — nothing runs locally.

Supported transport and auth ​

  • Streamable HTTP — recommended.
  • SSE — kept for legacy compatibility.
  • Authentication: no credential, Bearer token, or a custom header — the credential itself is a reference into your project's Vault, never pasted directly or serialized back in API responses.

Where it lives ​

Studio → Integrations → MCP servers. The flow: an install wizard with a mandatory connection test, transport/auth selection, a credential picker from the Vault, tool discovery with an initial allowlist, then ongoing controls (enable/disable, refresh the catalog, edit the allowlist, remove). Installed tools get a Playground built from the tool's own JSON Schema, and become available to the Studio Copilot.

An installation's state is one of connected, unreachable, disabled, or validating.

Security guardrails ​

  • HTTPS is required by default; insecure HTTP and private networks are disabled behind a flag.
  • localhost, loopback, link-local, cloud metadata endpoints, and private/reserved IPs are blocked.
  • Credentials embedded directly in a URL are rejected.
  • Automatic HTTP redirects are disabled; the HTTP client doesn't inherit process proxies.
  • Custom headers are validated against header injection.
  • Schemas, names, descriptions, arguments, and results all have size limits (staging values: MCP_EXTERNAL_MAX_TOOLS=100, MCP_EXTERNAL_MAX_SCHEMA_BYTES=32768, MCP_EXTERNAL_MAX_ARGUMENT_BYTES=131072, MCP_EXTERNAL_MAX_RESULT_BYTES=262144).
  • Credentials are never serialized back in API responses.
  • Every external MCP tool requires explicit approval before the Copilot can call it — even if the server advertises readOnlyHint.

One current limitation: DNS validation happens before the connection is made, but there's no additional network-level control (like an egress policy) as a second layer against DNS rebinding today.

© 2026 Machina Sports · machina.gg