Admin tab: External tools (MCP) + OAuth
AdminThe Administration → MCP servers tab manages the inbound direction of MCP: external tool servers whose tools the AI can use in chat and in agents. The concept behind it is explained in MCP in both directions; the step-by-step connection is described in Connect an MCP server.
Fields & options
Section titled “Fields & options”| Field | Meaning |
|---|---|
| Name | display name of the server |
| Transport | STDIO (local process) or SSE/HTTP (remote) |
| Command / URL | program invocation or server address |
| Arguments · Environment variables · Headers | depending on transport |
| Timeout | maximum response time |
| OAuth (optional) | Client Credentials or Authorization Code (with dynamic client registration) |
With Quick-Add you only enter a URL; CompanyWizard probes the server and, if needed, guides you through the OAuth flow. Server definitions can be imported/exported as JSON.
Limits & notes
Section titled “Limits & notes”- Admin-only.
- Which tools a server provides is RBAC-/configuration-bound. → RBAC & confidentiality
- Secrets: the OAuth client secret and tokens are stored encrypted. A server’s headers and environment variables, however, are stored unencrypted and are readable for administrators — put an API key there only with the narrowest scope. → Environment variables & appsettings
- PII: tool arguments are sent to the server pseudonymized by default. The checkbox “Trusted server — receives original PII values” (badge “PII trusted” in the list) lifts that for this server. → Trusted targets (PII egress)
- The server’s rights. CompanyWizard cannot set an MCP server tighter limits than the stored credentials do — the tool set comes from the server. → Permissions for connected tools
- For SQL-based custom tools (without an external server) see Configured tools.