MCP
MCP
MCP is how Max talks to AI tools outside it, in both directions (module mcp). Max serves its own tools over MCP, so an outside client such as Claude can use this deployment. And Max can connect to outside MCP servers, so agents here can be given their tools. The Connectors directory lists hosted MCP servers you can connect in a click or two.
In the sidebar under Connections → MCP and Connections → Connectors directory.
MCP
Waiting for you
Above everything else, one card per server that has tools waiting for a decision: "Waiting for you — ". Each waiting tool shows a side-by-side comparison: Approved — what agents see against Offered by the server, covering its description, its inputs and its hints. A badge says why it waits:
| Badge | Means |
|---|---|
| New — waiting for you | The server started offering this tool. Agents cannot see it until you approve it. |
| Changed — waiting for you | Its description, inputs or hints changed. Agents keep the approved version until you approve this one. |
| Now marked read-only — waiting for you | The server now says it only reads. Approving lets agents run it without asking, if this server's read-only marks are trusted. Until then it asks as before. |
A reworded description can steer a model, and a tool newly marked read-only would run without asking. That is why each change waits for a person. A tool the server stops offering simply disappears.
Servers
A table of the outside MCP servers connected here:
| Column | Shows |
|---|---|
| Server | Its name and URL |
| State | enabled or disabled |
| Key | set or none |
| Last error | The last thing that went wrong reaching it |
| Discovered | When its tool list was last fetched |
| Tools | What it offers, or "none discovered" |
Above the table, Servers counts them and Failing counts those with an error. Servers people connected from the Connectors directory are listed here too. A person's own appear only to them, and a server from the directory shows each tool's mark: reads, changes something, deletes, or moves money.
Connectors directory
Hosted MCP servers you can connect, and your own.
- Discover: search the directory, browse Featured collections such as For crypto or For sites, filter by Category, and press + on a card to connect it. A server that needs no account connects at once. Others ask you to sign in at the service or paste a key, and say where to make one.
- Yours: the servers you connected and the organisation's: their tools, what waits for your review, and which agents have them. Give it to an agent, Take away, Approve all reads, Make it the organisation's or Remove.
- + Add → Custom connector: add any MCP server on the public internet by its address. It is yours and private until an administrator makes it the organisation's. Private, local or internal addresses are refused.
- Manage (administrators): switch directory entries on or off for this organisation or The whole instance, edit entries, Add starter entries, and Check the registry for new or changed servers to Accept.
Nothing a server offers reaches an agent until you approve it and give the server to that agent. Tools that move money always ask, every time, and some tools are blocked by the directory and never offered.
What you can do
Add an outside server
- Open Connections → MCP and press Add server.
- Fill in the form:
- Name, and the URL of its MCP endpoint (
https://…/mcp). - Sign in as: an account signed in on the Connectors page, such as an X account for X's own MCP server. Its token is renewed by itself and sent instead of a key.
- Or Key: the API key the server gave you. It is sent as an
Authorizationbearer header, or under Key header if the server wants another header. It is never shown again once saved. Leave it empty on edit to keep the stored one, or tick Remove the stored key. - Transport: HTTP, the only one this deployment can reach.
- Enabled: a disabled server is kept, with what was discovered from it, but nothing calls it.
- Trust read-only marks: when on, a tool the server marks read-only runs without asking. Everything else asks for approval first.
- Name, and the URL of its MCP endpoint (
- Save, then press Discover on its row. The server is asked what tools it offers.
A failure to reach the server is recorded under Last error. The last list it gave keeps working meanwhile.
Approve or reject a waiting tool
- Read the comparison on the waiting card.
- Press Approve to make the offered version what agents see, or Reject to keep the approved version (or, for a new tool, never show it).
- With several waiting on one server, Approve all approves each one exactly as the server now describes it.
A rejected offer stays rejected if the server offers exactly the same thing again. Only a person signed in as themselves can decide. Agents, API keys and connected apps are refused, so nothing can approve the tools it is about to be offered.
Give an agent a server's tools
Connecting a server gives nobody anything by itself. On the Agents page, open Outside tools for an agent and tick the servers it may use, or use Give it to an agent in the Connectors directory. It is offered only their approved tools. An approval rule about one of these tools names it with an mcp__ prefix. An allow on it covers the version that was approved: once a changed version is approved here, the allow stops applying, while a deny or ask still holds (see Approvals).
Whatever an outside server answers is outside content. Once a run has read it, every later act that is not a read asks a person. This carries across MCP calls too.
Connect an outside client to Max
Max's own MCP endpoint is https://<your-deployment>/api/mcp. It is stateless: each request stands on its own credential. A client reaches it with an API key, or by signing in as a person through Connected apps. Either way it sees only the tools its holder may call. API keys and MCP access explains how to make a narrow key and connect.
Which of Max's own modules MCP clients may reach at all is shared configuration, set over the API at /api/mcp/access with mcp:write by a person signed in as themselves. A module can be switched off, capped to reads, or have single tools disabled, and the whole setting reset to "everything installed". The same place sets the tools every client lists first. brain.context is always among them for a caller who can use it.
Who can do what
| Permission | Label | Lets you |
|---|---|---|
mcp:read | Use the MCP surface | Reach Max's MCP endpoint at all, and see the servers, the directory and the tools waiting on them. A key without it cannot reach /api/mcp. |
mcp:write | Manage MCP connections | Add, change, discover and remove servers, connect from the directory, approve or reject waiting tools, give servers to agents, and set which of Max's modules MCP clients may reach. |
mcp:manage | Switch catalogue entries on or off for this organisation, and make a connection the organisation's | Manage the Connectors directory for the organisation. |
Adding, changing, discovering and removing servers is refused to an API key, even one acting as you. Those acts decide what agents here can reach, so a person does them.
What happens on its own
| Job | When | What it does |
|---|---|---|
check | Every hour at 17 minutes past | Asks each directory connection and custom connector that is due (at least once a day) for its tools, holds what changed for a person, and tells the owner once per change. Also rechecks sign-in permissions and moved addresses. |
registry | Every day at 03:40 UTC | Reads the public registry for new or changed servers, only when an administrator chose a schedule. None is set by default. |
Needs
Nothing has to be switched on first.
What agents can do
An agent can read the directory and which tools wait on a server. Deciding is for people only: the deciding tool refuses an agent and an API key. Connecting a server from the directory is a person's act. An agent asks for one with connectors.request_handle.
Read only: mcp.catalogue, mcp.heldTools
Change, people only: mcp.decideHeldTool
Reading waiting tools hands the run the outside server's own words, so it counts as outside content. Over MCP the same tools are named mcp__catalogue, mcp__heldTools and mcp__decideHeldTool (see API keys and MCP access).