How MCP Servers Work in Outermind
An MCP server connection gives your agents a vendor's own tools. The Model Context Protocol (MCP) is an open standard a vendor uses to publish the actions of its product as tools an AI agent can call. Outermind connects to the server the vendor hosts, discovers its tools, makes them active, and turns them into tools you grant to agents like any other tool.
This page explains what happens at each step and the safeguards that apply to every MCP server. Sixteen vendors also have their own setup guide in this section, saying what to prepare on the vendor side before you press Add MCP server; see Setup guides at the end of this page.
Where to find it
Open the Capabilities hub and click MCP Servers under Tool Management. The page is a grid of cards, with a search box and a category filter above it, in two sections:
- Connected has one card per connection: the vendor's logo (a generic server icon for a custom endpoint), the display name, the server's host, a status badge (Active, or Needs attention when the connection needs reauth or is disconnected), how many tools and actions it provides, when it last synced, and a badge when a staged operation needs your attention. Click Manage to open the connection. A connection whose setup stopped before its tools were discovered also shows Finish setup, which returns you to the wizard.
- Available has one card per known server you have not connected yet. Click Connect to open the wizard with that server already picked. A server that takes your own host, such as n8n, stays in this section after you connect it, as Connect another, because you can connect it more than once. The last card, Custom endpoint, opens the wizard on Other endpoint for a server that is not in the list.
Some servers, such as Pax8, are partner tools: only a tenant that is also an Outermind partner can connect them, and their card on the Connections page carries a Partner tool badge. On a tenant that is not an active partner (including a partner whose billing is suspended), such a server is not listed under Available, and connecting or reconnecting it, for example by typing its address under Custom endpoint, shows "This MCP server is a partner tool: only a tenant that is also an Outermind partner can connect it."
You can also reach this page from Connections: Manage on an MCP server's card there opens its connection, or, when you have connected the same server more than once, opens this page with the search already set to that server.
Click Add MCP server to start the three-step wizard: Endpoint, Credential and Summary.
What an MCP server connection is
- The vendor runs the server, not Outermind. Outermind connects to a server the vendor hosts, or, for a
product you run yourself such as n8n, to your own instance, at a public
https://address. An address that is nothttps://, or that points at a private or internal network, is refused. - One connection is one server. Each connection has a display name you choose. Outermind builds a short slug
from that name and puts it at the front of every tool the server provides, so two servers that both offer a
searchtool never collide, and you can always tell which server a tool belongs to. - It acts as the person who consented. Every agent action is attributed at the vendor to the admin who signed in, or, for a bearer token, to the vendor account that issued the token. Where the vendor lets you choose permissions when you sign in, the permissions you grant there are a hard ceiling no agent can go beyond.
- Tools are only usable while the connection is Active. If the vendor stops accepting the connection's credential, the connection shows Needs reauth and its tools disappear from every agent until an admin clicks Reconnect.
Step 1: Endpoint
Pick your vendor from Known server. Outermind has verified each server in this list, and picking one fills in the endpoint and shows:
- a short sentence naming the step you take at the vendor first;
- the Expected sign-in, either OAuth sign-in or Bearer token;
- for the vendors that have a guide in this section, a Setup guide link to it.
Four known servers serve each customer on a host of its own:
- Dynamics 365 (Dataverse) takes your environment's host under
dynamics.com; - ActiveCampaign takes your account's host under
activehosted.com; - n8n takes your n8n Cloud instance's host under
app.n8n.cloud; - n8n (self-hosted) takes the public
https://host of your own n8n instance. Because Outermind cannot confirm that such a host runs n8n, it needs the Platform plan, the same as a custom endpoint.
For these, the wizard replaces the endpoint field with an Organisation host field, and Outermind builds the endpoint from the host you type.
To connect a server that is not in the list, choose Other endpoint and type its full https:// address.
Display name defaults to the vendor's name. Change it if you plan to connect more than one server from the same vendor, because the slug in every tool name comes from it.
Purpose is a short, one-line description of what the server is for, shown beside it in every agent's tool list. For a known server, Outermind fills in a default; a custom endpoint starts with an empty purpose. See Purpose below for what it is for and the rules Outermind applies when you save it.
Step 2: Credential
Outermind checks the endpoint once and chooses one of two sign-in modes. A server that answers without asking for any credential is refused, because a server anyone can call is not one your agents should be routed through.
Above the credential control, the wizard repeats two facts: the connection acts as the person who consented, and the permissions granted at sign-in are a hard ceiling.
OAuth sign-in
The wizard says "This server uses OAuth. Connect opens the vendor's consent page in a new window." Click Connect, sign in at the vendor and approve. Outermind uses OAuth 2.1 sign-in with PKCE, stores the resulting tokens encrypted, and refreshes them automatically. If your browser blocks the window, the wizard continues in the same tab and picks up where it left off when you return.
For a known server, the wizard also shows one sentence saying how Outermind identifies itself to that vendor:
| What the wizard says | What it means for you |
|---|---|
| Outermind registers itself with this server automatically when you connect. | Nothing to prepare beyond signing in. |
| Outermind signs in with its own application registered with this provider. | Outermind has already registered an application with the vendor. You register nothing, although the vendor may require an admin on your side to allow it. |
| This provider needs an application created in your own account; you will supply its client ID and secret. | You create an application in your own vendor account first and paste its client ID and secret into the wizard. The vendor's setup guide says how. |
Bearer token
Some vendors issue a static token instead of an OAuth sign-in. Paste it into Bearer token and click Connect. Outermind stores the token encrypted, never shows it again, and sends it with every request. A token does not refresh: if the vendor later rejects it, the connection shows Needs reauth, and you paste a new token through Reconnect.
Step 3: Summary
Outermind asks the server for its tool list and makes active, at once, every tool it can offer safely: nothing is held back for you to look over first, once you grant a tool it is ready for an agent to use. A tool Outermind cannot offer safely, such as one whose input format it could not make safe, whose name cannot be represented, or whose description reads like an attempt to instruct the agent, is excluded instead; tool descriptions come from the vendor and are treated as untrusted text.
The summary shows how many tools and how many actions were connected, how many were excluded, a link to the connection page, and Grant tools to agents.
Under Grant tools to agents, choose an agent. Its Tools tab opens on this server's tools, so you can choose an access level for each one, exactly as you do for any other tool. The same list is on the connection page. No agent can use a tool until it is granted.
To leave a tool out, or bring one back in, open the connection with Manage afterwards and use its operations table; see Managing a connection. The wizard itself has no step for this.
Purpose
Every connection carries a one-line purpose, at most 120 characters, that agents see beside the server in their tool list, for example "corporate cards, bills and reimbursements". It helps an agent choose the right server when more than one could plausibly apply.
Known servers come with a default purpose that Outermind wrote; a custom endpoint starts with no purpose. Edit it in the wizard's Endpoint step, or at any time on the connection page.
Outermind refuses to save a purpose that contains a line break, is over 120 characters, or reads like an instruction to the agent; describe what the server is for instead. A connection created before this feature shipped has no purpose until an admin sets one on its connection page.
Risk tiers
Every action carries a risk tier. An agent's autonomy level decides which tiers it runs without asking a
person: Auto Approve Low runs read and low actions, Auto Approve Medium also runs medium, and
Full Autonomy also runs high. Agents are created at Auto Approve Medium unless someone chooses another
level, and an approver who chooses to always allow an action lets it run without asking again. Check the autonomy
level of every agent you grant a high action to.
For an MCP server, the starting tier depends only on the class:
| Class | Starting tier |
|---|---|
read | low |
write | high |
delete | high |
admin | high |
Read actions start at tier low, and every other action starts at high. Outermind does not trust a verb
in a tool name or the server's description of its own tool to make an action safer than that.
Why writes start at high
Outermind's earlier built-in integrations for several of these vendors carried their own safeguards, such as a spending cap or an approval step built into the integration. Vendor MCP servers have no equivalent: when the server is asked to approve a transaction, change a budget or delete a record, it does it. The risk tier is therefore the guard between an agent and an action that changes something at the vendor, and it starts at the safest setting.
Lowering a tier
A tenant admin may lower the tier of a single action on the connection page, within the limits that apply to its class:
| Class | Tiers it may be set to |
|---|---|
read | read or low |
write | any tier |
delete | medium or high |
admin | high only |
Every lowering is recorded with the action, the old and new tier and the admin who made it, is listed on the connection page under Recent changes and deviations, and is reported in the next brief to the supervisor of every agent that holds the tool. If the action's class is later raised, the lowering is cleared and the tier returns to its starting value. Only a tenant admin can lower a tier, and the platform can turn lowering off; when it is off, the option is shown disabled with the reason.
Leave actions that move money, delete data, publish or change permissions at high. Lower a tier only for an
action whose effects you would be comfortable seeing an agent take without asking.
Re-sync and staged operations
Vendors add, change and remove tools over time. Outermind re-checks every active connection once every 24 hours, and you can click Re-sync on the connection page at any time. Most changes apply at once, with no admin step: a new tool or action becomes active and ready to grant, and a removal takes an agent's reach away immediately. The one change that waits for an admin is a vendor now describing an action that is already active as SAFER than before, for example a write now described as read-only, because releasing it would widen what an existing grant already allows:
| What changed at the vendor | What happens automatically | What you do |
|---|---|---|
| A tool is no longer listed | The action is removed from agents at once. A tool with no actions left is deleted, along with its grants. | Nothing. |
| A new tool appears | It becomes active at once, at the tier in Risk tiers, and is ready to grant. | Grant it to agents on their Tools tab, as you would any new tool. |
| A new action appears on a tool an agent already holds | It is live for that agent at once, up to the level already granted. | Nothing, unless you want to change the grant. |
| A tool's input or description changed | Outermind re-checks it. If it can no longer be used safely, it moves to the excluded list. | Nothing, unless you want to look at the exclusion. |
| The server now describes a tool as more dangerous | The stricter class applies at once. | Nothing. |
| The server now describes a tool as safer | The action is held from agents until you confirm it. If it was the tool's only action, the tool and its grants are removed meanwhile. | Check its new, lower class and tier on the connection page, then click Confirm staged operations to release it at that tier (grant the tool again if it was removed), or untick it to leave it out. |
A failed re-sync changes nothing: the connection keeps serving the tools it already has, and the connection page marks the last sync as failed.
When Outermind changes how it reads a class, an existing connection picks the change up at its next re-sync in
the same way. A destructive tool whose verb is not a delete, which Outermind previously classed as delete, now
reads write; that is a lower class, so the action is staged for you to confirm, as in the last row above. The
names Outermind already gave a connection's tools are never changed by a re-sync: a better reading of a tool's
name applies only to tools the server lists for the first time.
Files stay at the vendor
Outermind does not copy files from an MCP server into Outermind storage; a file stays at the vendor under the vendor's own access controls. A link to it reaches the agent when the server includes the link in the tool's text result. Images, audio, and files or file links returned as separate attachments to the result are not passed to the agent; the agent is told that this content was left out.
Managing a connection
Click Manage on a connection's card to see its status (Active, Needs reauth or Disconnected), its host, who consented, the permissions the vendor granted, its tools, its last sync, its purpose, and the vendor setup sentence with its Setup guide link. From there:
- Re-sync checks the server for changes now.
- Reconnect repeats the sign-in (or asks for a new bearer token) and then re-syncs.
- Disconnect asks the vendor to revoke Outermind's access where the vendor supports it, then deletes the connection's tools and every grant of them. A disconnected connection stays under Connected. Reconnecting it brings its tools back active at the next sync; grant them to agents again.
- Confirm staged operations releases an action a re-sync has staged; see Re-sync and staged operations.
The operations table is the only place you include or exclude a tool, and it shows, for each one:
| Column | What it shows |
|---|---|
| Include | Untick a tool to leave it out. A left-out tool is neither searchable nor callable by any agent. Tick it again to bring it back. |
| Resource and Action | How Outermind grouped the tool and which action it became. Edit them if the grouping is wrong. |
| MCP tool name | The vendor's own name for the tool, exactly as the server listed it. |
| Derived class and Class | What the tool does: read, write, delete or admin. You can override the class, but a delete is never lowered. |
| Tier | The risk tier. See Risk tiers. |
| Flags | Extra properties the server declared, such as being safe to repeat. |
Outermind derives the class from two readings and keeps the stricter one: what the server says about the tool,
and the verb in the tool's name. The verb is read at the start or end of the name first, and anywhere in the
name when neither is a verb (account_get_logs reads get); a name that is only a verb (search) uses that
verb. A tool is a read only when the server also marks it read-only, so a server that says nothing about its
tools lands every tool as at least a write, never as a read. A tool the server marks destructive is a
delete only when its verb is a delete; any other destructive tool, such as a create or a send, is a write
that still starts at tier high. The class decides the access level an agent needs to use the action: Reader
for read, Contributor for write, Maintainer for delete and Administrator for admin.
Below the table, Excluded tools lists anything Outermind could not offer safely, with the reason: a tool whose input format it could not make safe, a tool whose name cannot be represented, or a tool whose description contains text that looks like an attempt to instruct the agent. Tool descriptions come from the vendor and are treated as untrusted text. A tool you excluded yourself appears there too, with an Include button that brings it back.
Two more sections may appear:
- Name collisions lists a tool whose resource and action were already taken by another tool. Outermind gives it a place of its own; edit its Resource and Action if it belongs somewhere else.
- Split tools lists a group of actions too large to offer to an agent as one tool. Outermind offers each of those actions as its own tool instead.
Click Save changes to apply an edit you make on this page. While a staged action is waiting, an include or exclude edit cannot be saved, because saving it would also release the staged action: untick any staged action you want to leave out and click Confirm staged operations first.
Redirect URIs
When you sign in to a vendor, the vendor sends you back to Outermind at a redirect URI (sometimes called a callback URL). You only need these when the vendor's setup guide asks you to register an application yourself or to allow Outermind's redirect domain.
Outermind signs in through the URI for the region your Outermind organisation is hosted in, so that one is required. Adding the four production URIs (US, UK, EU and AU) covers every region. The QA and local development URIs, the last two below, serve only Outermind's own test environments, so add them only if Outermind support asks you to.
https://us-api.outermind.ai/api/mcp-oauth/callback
https://uk-api.outermind.ai/api/mcp-oauth/callback
https://eu-api.outermind.ai/api/mcp-oauth/callback
https://au-api.outermind.ai/api/mcp-oauth/callback
https://qa-api.outermind.ai/api/mcp-oauth/callback
http://localhost:4071/api/mcp-oauth/callback
Setup guides
Each guide covers what you need before you start, the steps at the vendor, what agents can then do, what is not available, and any billing the vendor applies.
- Ramp - finance operations; sign in and approve.
- Zapier - your Zapier actions; create a server at Zapier and paste its token.
- Notion - pages, databases and comments; sign in and approve.
- Atlassian - Jira, Confluence and more; sign in and approve, and your organisation admin may need to allow Outermind.
- Plane - Plane Cloud projects and work items; sign in and approve.
- Meta Ads - Meta advertising; sign in with a Business account.
- Salesforce - Salesforce records; create an External Client App in your org first.
- Dynamics 365 (Dataverse) - Dataverse data; a Power Platform admin allows Outermind first.
- Pax8 - Pax8 marketplace data, read only; sign in with a partner account that has Integrations Hub access.
- Make - your Make scenarios and account; sign in and approve, or paste a static MCP token.
- n8n - your n8n workflows on n8n Cloud or a self-hosted instance; an instance admin enables the MCP server first, and you type your instance host.
- ActiveCampaign - contacts, deals and campaigns; type your account host, then sign in and approve.
- Dropbox - your Dropbox files; sign in and approve.
- DocuSign - envelopes and templates; sign in with a paid DocuSign account.
- Zoom - meetings, recordings and summaries; sign in with a paid Zoom account that has AI Companion.
- Affinity - relationship intelligence for deals and contacts; register an OAuth client in your Affinity account first.
Related
- Tools - how agents use tools
- HTTP API Tools - connect an API that has no MCP server