Tools from somebody else's machine (MCP)

An MCP server is a machine somebody else runs whose tools your agent can call as if they were its own. Your team registers one once — a name, an address, and the names of the credentials it asks for — and connects it to as many agents as it likes.

There are three ways that registration happens: a form, a sentence in a chat, and a bare domain name. This page is all three, and what you see after each.

This is the client half

Everything else in these docs that says "MCP" is Agentfy being an MCP server — the tool channel a worker speaks, and the api's own exposure. This page is the opposite direction: we are the client, dialling out to somebody else's server.

What a registration is

One row, owned by the team and not by an agent:

name	what a person calls it — «DeepWiki». Never a tool name: the tools are whatever the server answers with, unprefixed
address	its Streamable HTTP address, https://mcp.example.com/mcp
credential names	service:Header shaped — deepwiki:Authorization. Names, never values
where it may be dialled	the operator's ceiling intersected with what the team asked for
its tools	the last answer the server gave, kept on the row

Connecting it to an agent is a second, separate act. Two agents on one server is one registration and two connections, and disconnecting one of them does not touch the other.

Where the screens are

the team's list	the workspace rail — the plug icon, which carries no caption; the word «MCPs» appears as the heading once you are there (/teams/<team>/mcps)
one agent's	open the agent → the MCPs tab

The tab is absent on agent types that may not have servers at all — the api refuses the connection for them, and the tab disappears because of that refusal rather than instead of it.

The three tools, if you meet them in a transcript

An agent does this with named tools, and the names show up in a conversation's trace:

connect_mcp_server	register a server and attach it to this agent
discover_mcp_server	given a bare domain, read what that domain announces
check_mcp_server	dial an attached server and report what actually happened

None of them takes an agent id or a team id. «Connect a server to somebody else's agent» is not something the model can express, let alone be refused for.

In the database, a registration is one AgentMcpServer row and each connection to an agent is one AgentMcpServerUse — which is why disconnecting one agent is the deletion of a single row and cannot touch another.

1. Register one by hand

On the team's MCPs screen:

1. What to call it — «DeepWiki».
2. Address — https://mcp.deepwiki.com/mcp.
3. Credential names, comma separated — leave empty if the server needs none.
4. Register a server.

What you see when it worked: the row appears with Tools listed under it and Asked carrying a timestamp. That list is the server's own answer, not a guess — if it is empty the row says The server has not said what it can do.

What you see when it did not: the row still appears, with Could not be reached and the reason. Ask again re-dials it; a successful re-dial clears the message, so it is never stale blame.

Then open an agent → MCPs → Connect one the team already has → pick it. The agent's next turn has those tools.

2. Ask the agent to do it

You do not have to open a screen at all. Paste the address into a chat with the agent and say «connect this» — the agent has the tool for it and knows to use it:

Connect the MCP server at https://mcp.deepwiki.com/mcp, call it DeepWiki.

An agent that can do this will not answer that this has to be done in the settings. It registers the server for the team and connects it to itself, and the row it creates is marked added by the agent on the team's screen — so «who put this here» is answerable afterwards.

Never type an API key into the chat. If the server needs one, the agent asks for it the way it asks for any credential: the key lands unfilled on the agent's Secrets screen and you type the value there. The connect tool takes the name of a key and refuses a value.

When a connected server stops working, ask the agent what is wrong with it. It dials the server and reports what actually happened, rather than guessing about itself.

3. Give only a domain

Often nobody has the exact address — they know the company. That is enough:

Connect the MCP from dreamvention.com.

The agent reads one file at one address: https://<domain>/.well-known/mcp.json, the announcement a domain publishes about its own server. If there is one, you get back the address, the transport and what the server says it can do, and the agent goes on to connect it. If there is none, the agent says so and asks for the address — in that order, so nobody is sent to an administrator to «open access» first.

The narrowness is the point, and it is deliberate:

one path	/.well-known/mcp.json — there is no path to ask for
one host	the one the person named
one method, one scheme	GET, https
no credentials	not the team's, not anybody's — nobody has yet said who answers there
bounded	five seconds and 64 KiB, because a stranger's address must not be able to hang a turn

A file on a.com that declares a server on b.com is a redirect written in words. It is not followed silently: the agent brings it back to the person and asks.

Credentials, in one rule

A name is service:Header shaped, and the part after the last colon is the HTTP header the value is sent as. deepwiki:Authorization means: take the value the team stored under this name and send it as the Authorization header. That is the whole of the mechanism; there is no second place to configure headers.

The names go on the registration; the values live in the team's shared secrets and never pass through the registration endpoint. Removing a server does not delete the credentials — another server may be using them.

Where a server may be dialled

The address you type is the address the api dials, and the api is the process holding the database and the encryption key. So a registration is not free to point anywhere:

• the operator sets a ceiling for the whole installation;
• a team may ask for less, never more — the narrower of the two wins;
• loopback, the private ranges, link-local and the cloud metadata address are refused, and the check resolves the name and looks at every address it comes back as;
• redirects are not followed.

What a turn actually pays for

The tools a turn offers the model come off the stored list. Nothing is dialled while a person is waiting: a server that accepts a connection and then never answers would otherwise cost minutes on every single turn. Ask again is how the list is refreshed, and an agent can ask for the same refresh from a chat.

Two things a connected server never gets: the conversation, and the system prompt. It is given the arguments the model chose and its own credentials, and nothing else.

A visitor from your website gets none of these tools, whatever the owner opened on that channel.

Deliberately not here yet

• stdio servers. They mean spawning a process next to the web server. They belong to the worker's own channel, later.
• The bundle. A one-click card carrying a server, its credentials and its skills together is the thing that will earn the name «app». One connection is not that.

The reasoning behind every shape on this page, and the measurements that chose it, are in specs/AGNT2-327-agent-app/research.md, specs/AGNT2-329-mcp-step-1/ and specs/AGNT2-330-agent-connects-mcp/. They are the original; this page is the summary.

Check it end to end

1. Open the workspace rail and click the plug icon, or go straight to /teams/<team>/mcps.
2. Register https://mcp.deepwiki.com/mcp as «DeepWiki», no credential names.
3. The row must show a non-empty Tools list and an Asked timestamp.
4. Open any agent that has an MCPs tab → Connect one the team already has → DeepWiki.
5. In that agent's chat, ask it to use one of the tools you saw in step 3.

The tool call appears in the turn, and the answer comes back with the server's own result. If step 3 shows Could not be reached, the address, the operator's ceiling or the server itself is the cause — in that order of likelihood.