Management — MCP Proxy

Navigate to: Dashboard → MCP Proxy

What it shows: MCP (Model Context Protocol) servers registered with AgentWatch. The MCP Proxy lets AI agents call external tools and data sources through a centralized, access-controlled gateway.

Step-by-step: Register an MCP server

1. Click MCP Proxy in the sidebar.
2. Click Add Server.
3. Fill in:
   • Name — display label (e.g., Internal DB Tools)
   • Server URL — the MCP server’s HTTP or SSE endpoint
   • Transport — HTTP, SSE, or WebSocket
   • Auth Token — Bearer token if the server requires authentication
4. Click Test Connection — AgentWatch pings the server and lists its available tools.
5. Click Save.

Step-by-step: Configure access control

1. Open an MCP server record.
2. Click Access Control.
3. By default all tenants can access the server. Toggle Restrict Access on.
4. Add the team IDs or tenant IDs allowed to use this server.
5. Click Save — requests from unlisted tenants receive 403 forbidden.

Step-by-step: Test an MCP server via the proxy

1. Retrieve your API key from Employee Management.
2. Send a request to POST /mcp-proxy/:serverId/mcp with the tool call payload.
3. The proxy forwards the request, applies ACLs, logs the call, and returns the response.

Endpoints exposed to AI agents:

Transport	Path	Use case
HTTP	POST /mcp-proxy/:serverId/mcp	Standard tool invocation
SSE	GET /mcp-proxy/:serverId/sse	Streaming tool results
WebSocket	WS /mcp-proxy/:serverId/ws	Real-time bidirectional

How to test:

1. Register a local MCP server (you can run the bundled MCP server at npm run start:mcp).
2. Use its server ID in a request to POST /mcp-proxy/:serverId/mcp.
3. Check the response matches what the MCP server would return directly.
4. Enable ACL restriction, send the same request with an unauthorized tenant key — should receive 403.

Cross-reference: For the full ACL configuration reference see section 9.1.

---