Skip to main content
Model Context Protocol (MCP) is an open protocol for connecting AI agents to external tools and data sources. Add any service that exposes an MCP server — an internal metrics system, a ticketing platform, a legacy integration — as a custom connection, and every agent can call its tools. CloudThinker authenticates to your server with the HTTP headers you configure, typically an Authorization header carrying a token your server validates.

​
Prerequisites

  • An MCP server reachable from CloudThinker over HTTPS, speaking either the Streamable HTTP or SSE transport.
  • The server’s endpoint URL.
  • Any header values your server requires for authentication, such as a bearer token.

​
Setup

1

Create the connection

Navigate to Connections → MCP and click Add MCP Connection.
2

Name it and choose a prefix

Enter:
  • Connection Name: a descriptive display name
  • Description: optional
  • Prefix: a short handle for this server. Its tools appear to agents as prefix__tool_name, so a server with prefix weather exposing get_forecast becomes weather__get_forecast.
3

Configure the transport

Select the Transport Type your server speaks — Streamable HTTP or SSE — and enter:
  • URL: the server endpoint, such as https://example.com/mcp
  • Timeout: connection timeout in seconds (default 30)
  • SSE Read Timeout: event stream timeout in seconds (default 300)
4

Add headers

Add any HTTP headers your server needs, as key-value pairs — typically Authorization with a value like Bearer your-token. Headers are sent to the MCP server on every request.
5

Connect

Click Connect. CloudThinker contacts the server, loads its tool definitions, and shows a Connected status when the server responds correctly.
The URL must not embed credentials (user:password@host). Put authentication in a header instead — for basic auth, Authorization with Basic <base64(user:password)>.

​
Connection details

​
Required permissions

Authentication is between CloudThinker and your server: whatever token or credential you place in the headers defines what the connection can do. Issue your server a credential dedicated to CloudThinker, scoped to the least access its tools need, and have the server validate it on every request.
Only expose the tools agents should have. A tool your server does not serve cannot be called, which is a stronger boundary than any setting inside CloudThinker.

​
Agent capabilities

Once connected, every tool your server exposes becomes an agent tool named prefix__tool_name, available to all agents in the workspace alongside the built-in connections. You stay in control per tool: open the connection’s Tool permissions panel to disable individual tools or mark a tool as requiring your approval before each call. Tools your server marks as changing state should carry the approval requirement, so agents state the inputs and wait for your confirmation first.

​
Verify the connection

​
Example prompts

​
Troubleshooting

Verify the MCP server is running, check network connectivity from CloudThinker, increase the Timeout value, and confirm the firewall allows the traffic.
Verify the prefix is set, check that the server returns tool definitions, ensure the protocol version is compatible, and review the server’s own logs for errors. Also check the Tool permissions panel — a disabled tool is hidden from agents.
Verify the header values are set correctly, that the token or key is still valid on your server, and that the server validates the credential the way you expect.
Increase the SSE Read Timeout, check for proxy interference, verify the server sends keepalive events, and review network stability.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • HTTPS endpoints only — the headers, including your credential, are sent on every request, and your server should validate them before processing.
  • Rotate header credentials — replace the token on your server and in the connection’s headers on your normal rotation schedule.

Connections Overview

All connection types

Agents

How agents use connections