Connect Your Own MCP Servers: Bring Any Tool to Your CellCog Agents

§ 01What MCP is, in one paragraph

MCP - the Model Context Protocol - is the open standard AI platforms use to connect to tool servers. A remote MCP server is an https endpoint that can answer two questions: what tools do you have? and run this tool with these arguments. Because it’s a standard, one server works everywhere the standard is spoken: the custom connectors in other major AI products are MCP servers, growing numbers of vendors ship official MCP endpoints, and teams increasingly wrap internal APIs in one. Now CellCog speaks it too.

§ 02How it works

1. Add the server. Name, https URL, and authentication: none, or an API key sent as a Bearer token or a custom header. The key is held encrypted by our tools provider - never stored by CellCog, never visible to agents.
2. Tools are discovered automatically. CellCog connects and lists what the server offers - you see the discovered tools before you leave the page. The list re-syncs daily, and a Refresh button re-syncs it on demand.
3. Agents pick them up on their own. Every tool search an agent runs now includes a section listing your MCP servers and their tools. No prompting tricks, no setup in the chat - if the server is connected and Tools is on, your agents know about it.
4. Calls ride the same rails. An MCP tool call looks exactly like any other tool call: the same approval cards, the same per-chat Tools selector (include or exclude servers per chat), the same audit trail.

§ 03The safety model

Connecting a third-party server is a bigger trust decision than connecting a catalog tool, and the design treats it that way:

• Your existing approval threshold governs every call - nothing about your current setup changes.
• MCP calls are always at least moderate risk. A third-party server writes its own tool descriptions, and those descriptions aren’t vetted by CellCog. So a call to your own MCP server never rides your lowest auto-approve setting: if you review moderate actions, you review these.
• Servers are private to your account. No other user’s agents can discover, inspect, or call them.
• Agents treat server content as data, not instructions. Tool descriptions and results from a third-party server are handled as untrusted data, never as commands. An instruction embedded in a tool result is something the agent reports, not something it follows.

§ 04Everyone speaks MCP now. The trust model is where products differ.

That is the point of a standard: Claude’s custom connectors, ChatGPT’s custom apps, OpenClaw’s server configs, Grok Bot’s plugins - all MCP underneath. A server you stand up once works across all of them. So the question worth asking is no longer “does this product support MCP?” It is “what happens to trust once a third-party server is inside?”

Grok Bot’s answer, per its own documentation, is account-wide sharing: MCP authentication is shared across Cursor and Grok Bot, all of a user’s Bots share one cloud computer, and files, browser sessions, and command-line credentials on that computer are available across the whole Bot roster. Their docs are commendably direct about the consequence: “Do not use separate Bots as a security boundary.”

We made the opposite bet, because AI employees carry more autonomy than a coding assistant and the blast radius of a bad tool call is bigger:

• A server you add is private to your account, and every call from it is at least moderate risk - it never rides the lowest auto-approve setting.
• You can restrict each AI employee to exactly the tools and credentials it needs: anything you don’t grant never enters that employee’s environment, enforced on the server, not just hidden in the UI.
• Server content stays data. A tool description is never a command.

Neither answer is wrong for its product. A shared computer is convenient when your Bots are one person’s helpers. Per-employee scoping matters when your agents are staff: working different roles, holding different access, reachable by the outside world. If that is your situation, the boundary is the feature. (More on how we think about this: Grok Bot’s security model, explained.)

§ 05The honest caveats

MCP server support covers no-auth and API-key servers today; OAuth-based MCP servers are on the roadmap. A server’s URL and auth mode are fixed once added - changing either means removing and re-adding it. And the quality of what your agents can do with a server is bounded by the server itself: a well-described tool set gets used well, a vague one less so.

If you’ve been waiting to give your agents a tool the catalog doesn’t have - it’s probably one paste away now.