Registering from a remote MCP server
Tools’ Register Tool dialog has a Remote MCP source: enter the MCP name and server URL (plus optional key-value pairs, sent as HTTP headers when connecting - e.g.Authorization: Bearer ...), hit Load MCP server, and the engine connects (Streamable HTTP, with legacy SSE fallback) and lists the server’s tools. Review the list - select, rename, edit descriptions and parameter schemas - then register the keepers, individually or all at once. Each becomes an ordinary tool-schema row whose definition embeds an mcp provenance block, and the registry keeps MCP tools recognizable from it: rows are labeled mcp name > function name (e.g. paypal > create_invoice), and the label survives judge-proposed rewrites of the definition. Everything else about the registry applies unchanged: the engine never executes MCP tools in production, it observes your agent’s traced calls and improves the definitions. Listing is deliberately forgiving about schema quality - real-world servers ship parameter patterns that strict JSON-schema validators reject, and the engine lists them anyway and lets you clean them up in review.
Playground execution: adding an MCP-registered tool via the Playground’s “From Tool Schemas” picker prefills its server URL as the endpoint, and Playground/simulation runs execute the tool’s calls over the real MCP protocol (registry browsing stays execution-free - only runs you start execute anything). Works for open and header-free servers out of the box; OAuth-protected servers get a Connect button that runs the provider’s sign-in popup once and reuses the authorized session for subsequent calls (sliding expiry). Replacing the prefilled URL with your own endpoint switches that row back to the plain POST {tool, arguments} contract.
OAuth-protected servers (PayPal, Atlassian, and other servers that follow the MCP OAuth 2.1 spec) work without any manual key setup: when the server answers the first connection with an authorization challenge, the dashboard opens the provider’s consent page in a popup. Sign in and approve access there - the popup closes itself and the tool list loads automatically. The engine handles discovery, dynamic client registration, and the PKCE code exchange behind the scenes, holding the resulting tokens in memory only for the duration of the load (about 15 minutes at most); nothing OAuth-related is persisted with the registered tools. If your dashboard is served from a domain the engine can’t infer, set AGENTX_PUBLIC_URL so the OAuth callback (/api/v1/mcp-oauth/callback) resolves to a URL the provider can reach.