MCP servers
Connect Model Context Protocol servers to extend your bot with external tools, APIs, or knowledge. Configure labels, approvals, allowed tools, and authentication per server. Connect OAuth accounts such as Booklee without copying access tokens into headers.
- MCP access is gated by plan: Pro (1 server), Advanced (3), Enterprise (unlimited).
- Limits apply to your workspace's MCP inventory; saved servers can be reused by bots, agents, workflows, and Outreach projects.
- Open Dashboard → MCP Servers and click New MCP server.
- Enter Server label (display name) and Server URL.
- Choose Require approval: Always, Never, or If required.
- Optionally add Allowed tools (whitelist), then choose No authentication, Request headers / API key, or OAuth sign-in.
- Save the server. For OAuth, choose Connect with OAuth, review permissions, and click Continue with OAuth. Providers with automatic registration do not require a client ID or secret.
- Finish sign-in and consent on the provider's website, then attach the saved server to your bot, agent, or workflow.
Open an Outreach project's Settings → Connections → MCP server and choose Add new MCP server. The same creation form saves the server to your account or team's MCP inventory; your workspace's existing MCP allowance applies.
- Save the server URL and authentication method.
- For OAuth, review permissions and complete provider sign-in.
- Choose Connect server to attach the selected server to this project.
- Select and save the read tools Outreach may use.
Closing the chooser or cancelling OAuth keeps the saved server in your inventory. Select that server again to retry sign-in or reconnect. Saving a server does not automatically attach it or approve its tools, and connecting it to another project does not create another account server.
Read the Outreach guideAdd a saved MCP server named Booklee with the URL https://booklee.app/api/mcpand choose OAuth sign-in. AskRaian discovers Booklee's authorization server and supported permissions, then registers the connection automatically. Leave Advanced client registration empty; you do not need to create or copy a Booklee OAuth client ID or secret.
Review the selected business read permissions before connecting. Select additional permissions only when the tools you intend to use require them. Booklee's consent screen and your Booklee account determine which organizations and records you can access.
AskRaian stores tokens encrypted on the server and refreshes access when the provider permits it. Choose Reconnect if access expires or is revoked. Disconnect removes AskRaian's local credentials; you can also revoke the grant in the provider's account settings.
The connection test initializes MCP and lists available tools without calling them. Some servers publish their tool catalog before sign-in, so a successful test does not establish permission to run every tool.
OAuth servers must publish protected-resource and authorization-server metadata, support authorization codes with PKCE S256, and use public HTTPS endpoints. AskRaian supports dynamic client registration, Client ID Metadata Documents, and manually registered client IDs with an optional client secret. Dynamic registration is preferred when the provider offers it, so users can connect automatically without entering client credentials or exposing the AskRaian deployment to metadata fetches.
Manual registration is an alternative for providers that require it. Allow the callback URL https://your-askraian-host/api/mcp/oauth/callback. Advanced connection settings accept the client ID and secret. Secrets are write-only and encrypted.
Operators must configure WORKFLOW_SECRET_ENCRYPTION_KEY with a stable 32-byte encryption key. The optional MCP_OAUTH_REDIRECT_URImust match the environment's callback URL. Each staging or production environment uses its own host. Providers that offer only client metadata documents must be able to fetch /api/mcp/oauth/client-metadata publicly; deployment protection can prevent this. If protected staging returns HTTP 401 or 403 for that URL, the deployment owner must allow unauthenticated access to this single metadata endpoint. Keep the rest of the deployment protected. A provider-registered client entered in Advanced settings is another supported option.
- Server label: human-readable name.
- Server URL: MCP endpoint.
- Require approval: controls if tool calls need approval (Always/Never/If required).
- Allowed tools: optional whitelist of tool IDs.
- Headers: custom headers sent to the server.
- If you hit the server limit, upgrade your plan or remove an existing server.
- Use allowed tools to restrict the MCP surface area for security.
- Ensure headers are correct (e.g., Authorization) and avoid adding empty entries.
- If OAuth discovery fails, verify the endpoint and provider metadata. If registration is unavailable, register an OAuth client with the provider and enter its credentials in advanced settings.
- If the provider shows invalid_client because an AskRaian metadata document returned HTTP 401 or 403, close the sign-in window and start a new connection. Providers supporting dynamic registration, including Booklee, register automatically; no manual client credentials are needed. For metadata-only providers, check the protected-staging setup above.
- Allow the sign-in popup. If it expires, close it and connect again. Changing a server URL or authentication method clears its saved OAuth grant.
Next up
Connect WhatsApp via Meta Embedded Signup.