Connect a server
The steps every MCP server goes through, from registering its URL to the agent using it.
Who can: Owners, Admins and SREs. Everyone else sees the registry read-only, and Viewers don't see it.
Every server follows the same path. The server's page lists it under Lifecycle:
| Step | What you do | Why |
|---|---|---|
| 0 · connect | Connect (OAuth servers only) | Sign in once with the server; sremcp keeps the tokens. |
| 1 · test | Test connection | sremcp lists the server's tools. |
| 2 · approve | Tick tools, Save approvals | The agent only calls approved tools. |
| 3 · grant | Tick roles, Save access | Choose who may use this server. |
| 4 · activate | Activate | The agent starts using it. |
Before you start
sremcp connects to your server from sremcp's servers, not from your browser. The endpoint must be:
- https, with a valid certificate.
- Reachable from the internet when you use app.sremcp.com. Private addresses (10.x, 172.16–31.x, 192.168.x, loopback, link-local, cloud metadata) are refused. To connect a server that runs inside your network, see Expose a self-hosted server.
- A remote MCP server, over Streamable HTTP or SSE. Servers that only run locally over stdio need a small bridge. See Transports.
Register the server
Go to MCP servers and click Onboard server.
| Field | What to enter |
|---|---|
| Display name | How the server appears in sremcp, for example Grafana (prod). |
| Slug | A short id, lowercase. It's part of every tool name: mcp__grafana-prod__query_prometheus. |
| Endpoint URL | The MCP endpoint, often ending in /mcp. No passwords in the URL. |
| Transport | Streamable HTTP, or SSE (legacy) for older servers. |
| Authentication | Bearer token, Custom header, OAuth (sign in with the server) or None. See Authentication. |
| Secret | The token or key, for Bearer and Custom header. Encrypted, and never shown again. |
Click Save as draft. The server's page opens with status draft.
One server per environment
Onboard production and staging as two servers (grafana-prod, grafana-staging). Then you can grant QA staging only, and Managers production only.
Test the connection
Click Test connection. On success you'll see something like 28 tools discovered · 28 new. Tools whose names the agent can't use are listed as skipped.
If the test fails, the message says why: unreachable, refused credentials, not signed in. See Troubleshooting.
Approve, grant, activate
- Approve the tools the agent may call, and Save approvals.
- Grant roles under Role access, and Save access.
- Click Activate. sremcp only activates a server whose last test succeeded and that has at least one approved tool.
After it's live
- Health checks. sremcp re-lists every active server's tools regularly. A server that stops answering turns error, and the message on its page says why.
- Changed tools. If the server changes a tool's definition, the tool goes back to pending until someone approves it again.
- Disable takes a server out of the agent's hands without deleting anything. Delete server removes it, with its tools and grants.
- Rotate secret replaces the token or key. Reconnect refreshes an OAuth sign-in.