> ## Documentation Index > Fetch the complete documentation index at: https://docs.chatropic.com/llms.txt > Use this file to discover all available pages before exploring further. # Tools and MCP > Connect MCP servers with OAuth or a Bearer token and grant tools to subagents > [!NOTE] > > To connect your own AI client to Chatropic and access workspace knowledge, conversations, and billing, see [Connect your AI agent](https://docs.chatropic.com/user-guides/chatropic-mcp/connect.md). MCP connections belong to a workspace. Chatropic discovers a server's tools, but a subagent can use only the tools you grant. Use a remote **Streamable HTTP** endpoint, such as `https://mcp.example.com/api/mcp`. This transport supports JSON and SSE responses; legacy SSE-only endpoints and local stdio servers are not supported. ## Choose authentication | Authentication | Use it when | What you enter | | - | - | - | | **Automatic / OAuth** | The server supports OAuth sign-in, or does not require authentication | Server URL; advanced OAuth client settings only if required by the provider | | **Bearer token** | The server expects a shared secret in its Authorization header | The token's value, without the `Bearer ` prefix | > [!NOTE] > > A server environment variable such as `MCP_AUTH_TOKEN` stays on that server. Chatropic cannot read it automatically. For Bearer authentication, save the same value in Chatropic using the form below. Do not paste secrets into support messages or agent instructions. ## Connect with Automatic / OAuth ![Automatic OAuth authentication and optional client settings](https://mintcdn.com/chatropic/uDX354wrjCn327kK/images/mcp-oauth-setup.png?fit=max\&auto=format\&n=uDX354wrjCn327kK\&q=85\&s=ece6062cc72e253d03e9b2ba27347af1) Automatic / OAuth with advanced settings expanded. Local preview using placeholder data. 1. Open your agent's **Tools → Connect MCP** page. 2. Enter a **Connection name** and **Streamable HTTP URL**. 3. Leave **Authentication** set to **Automatic / OAuth**. 4. If the provider requires a registered client, expand **Advanced OAuth settings** and enter its Client ID, Client Secret, and Scopes. Otherwise leave them empty. 5. Select **Connect and discover**. If authentication is required, finish signing in and granting access in the provider's window. Servers without authentication connect directly. 6. Return to Chatropic and review the discovered tools. If a popup is blocked, allow popups for Chatropic and select **Sign in**. Chatropic also checks completion when the provider isolates its popup. Use **Cancel sign-in** to stop an authorization attempt; a denied or cancelled attempt leaves the connection available for retry. Existing OAuth connections retain their authorization and refresh behavior. ## Connect with a Bearer token ![Bearer token selected with a password input](https://mintcdn.com/chatropic/uDX354wrjCn327kK/images/mcp-bearer-setup.png?fit=max\&auto=format\&n=uDX354wrjCn327kK\&q=85\&s=e6df19a00fa3328b84e51323661582e4) Bearer-token setup. Local preview using placeholder data. 1. Open **Tools → Connect MCP**, then enter the name and server URL. 2. Select **Bearer token** under **Authentication**. 3. Paste the actual secret into **Bearer token**. For a server configured with `MCP_AUTH_TOKEN`, enter its value—not the variable name and not `Bearer `. 4. Select **Connect and discover**. Chatropic encrypts the credential, clears the input, and checks the server. This mode does not open an OAuth window. 5. Review the discovered tools. If checking fails after saving, **Token saved** confirms that you can retry without creating another connection. The token is shared by agents using this workspace connection. It is never returned to the browser after saving or included in exported YAML. ### Replace a token or repair a saved reference Open the connection details, select **Replace token**, enter **New Bearer token**, and select **Save token**. Then select **Check connection**. Saving replaces authentication for that connection; the previous secret is not displayed. Older connections may show **Saved credential reference**, such as `support_mcp_token`. That text is a lookup name, not a secret. Use **Replace token** to save a working value directly; you do not need a separate vault screen. Existing shared references are not deleted by this replacement. Existing OAuth connections continue to use sign-in. To change an OAuth connection to Bearer authentication, create a separate connection and update its tool grants after testing. ## Discover, grant, and test tools A successful check displays the number of discovered tools. Review their descriptions and schemas. Open the target subagent's **Tools** tab, choose **Add MCP tool**, and grant only the required tools. A connection alone does not grant tool access. Test successful and failing calls in Sandbox before **Set Live**. After replacing a token, test an actual tool call as well as discovery: the token may permit listing tools but lack permission for a particular business operation. A failed recheck retains **Previously discovered tools**; it does not mean those tools are currently reachable. Fix the connection and check again before relying on them. MCP credentials and grants are not included in exported YAML. ## Troubleshooting ![Token saved with an endpoint-not-found error and Retry discovery action](https://mintcdn.com/chatropic/uDX354wrjCn327kK/images/mcp-endpoint-error.png?fit=max\&auto=format\&n=uDX354wrjCn327kK\&q=85\&s=fdb8cbf98db779eb12dad4bacff16100) A saved credential and an unavailable endpoint are reported separately. Simulated 404 in the local preview. | Result | What it means | What to do | | - | - | - | | Saved token missing | No usable saved secret is available | Select **Replace token**, save the value, and check again | | Credential rejected (401/403) | The server rejected the token or its permissions | Check the secret and allowed operations; replace it if necessary. Do not fill OAuth fields for a static-token server | | Sign-in required | An Automatic / OAuth server requires authorization | Select **Sign in** and complete the provider's flow | | Endpoint not found (404) | The URL or deployment is unavailable; this does not prove a token problem | Verify the full URL and deployed MCP route. Create a corrected connection if the saved URL is wrong | | Render response includes `x-render-routing: no-server` | Render is not routing the request to the application | Verify the Render service and hostname before troubleshooting authentication | | Network or TLS error | Chatropic cannot reach the server securely | Check DNS, certificate validity, public availability, and server logs | | Connection check timed out | The server did not finish discovery within the deadline | Wake the service if necessary and retry. Check for stalled initialization or tool-list responses | | Invalid MCP response | The endpoint did not return a supported MCP response | Confirm the URL serves Streamable HTTP MCP rather than an HTML page or a legacy SSE endpoint | Discovery has a 25-second backend deadline; the proxy and browser allow a short additional interval to report the result. OAuth's interactive sign-in is a separate step. Use **Cancel** during initial checks or **Cancel check** in connection details to stop waiting. Retrying a saved connection does not create another one. When contacting support, provide the error message, time, server URL, and any correlation ID from backend logs. Never include the token or Authorization header. ## Connection images Upload or replace an image to identify a server. PNG, JPG, and WebP are supported up to **1 MB** and **2048 × 2048 pixels**. Removing the image restores the default icon. Images do not affect authentication or tool grants. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.