> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.moveworks.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.moveworks.com/_mcp/server.
# Connect and Manage Servers
MCP Workspace is available to a limited set of customers. Moveworks is validating the experience and gathering feedback, so capabilities and limits may change. To request access, [register your interest](https://community.moveworks.com/p/mcp-workspace-controlled-availability).
MCP Workspace is where an Agent Studio admin connects MCP servers and controls which users can reach them. This page covers the connection paths, authentication checks, access controls, and the first-time user experience.
## Before You Start
* Connecting servers is an Agent Studio admin task.
* A connected server does not grant anyone access to its upstream system. Each tool call uses the individual user's credentials and permissions in that system.
* Start with apps and use cases that do not overlap with an existing plugin or Enterprise Search. See [Configure and Test MCP Workspace](/agent-studio/mcp-workspace/configure-and-test-mcp-workspace).
Moveworks does not review, approve, or vet MCP servers or their tools. Review the full inventory before you make a server available. A server decides which tools and guardrails it exposes, including whether it offers write or destructive actions.
## Add the Required Name and Description
Every MCP server in MCP Workspace requires a **Name** and **Description**. Complete both fields when you create a preconfigured or custom server.
* **Name**: Use the name of the application or service behind the MCP server. Match the words users are likely to use in requests. For example, name a Linear server **Linear** so a request such as "Check my Linear issues" clearly matches it. For a custom server, use the name of the application or internal service it exposes, not **Custom MCP server** or a list of capabilities.
* **Description**: Explain the server's purpose, the kinds of tools it contains, and the range of functions and operations it supports. Include important boundaries, such as read-only access or operations the server does not provide.
The description is especially important for quality. The assistant uses it to understand the server's purpose and decide whether the server fits a request.
For example, a custom server for an internal application named Acme Benefits should use **Acme Benefits** as its Name. Its Description could be: "Looks up employee benefit eligibility, coverage, policy cost, and policy text. The tools are read-only and do not enroll employees or change benefit selections."
The MCP Workspace description is separate from the individual tool names and descriptions returned by the remote server. Both affect tool selection, so review the tool inventory after the server connects.
## Choose a Connection Path
| Server type | Use this path |
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A server in the preconfigured list | Select the server and use Dynamic Client Registration (DCR) to discover its OAuth settings and create the connection. |
| Any other MCP-compatible remote server | Select **Custom Server**, enter the server URL and path, then use DCR to create the connection. If the server does not support DCR, create or reuse an HTTP connector. |
## Connect a Preconfigured Server
Preconfigured servers have their connection details filled in for you. MCP Workspace uses DCR to discover their OAuth settings and register the client during setup.
In Agent Studio, create an MCP server and select the server from the preconfigured list.
Select **Discover OAuth Settings** and complete the authorization flow.
In the **Tools** section, select **Preview Tools**. If you see the expected inventory, the server is reachable and the administrator connection can authenticate.
Tool names and descriptions come from the server and are view-only in Agent Studio. The tools shown to an administrator are not necessarily the same tools each end user sees. MCP Workspace retrieves tools for each user at runtime based on that user's upstream permissions.
## Connect a Custom Server
Use the Custom Server path for a compatible remote server that is not in the preconfigured list, including a homegrown server.
Select **Custom Server**, then enter the base URL and path from the server owner's documentation.
Discover the server's OAuth settings and use DCR to create the connection. If the server does not support DCR, create or reuse an HTTP connector that you already configured for that system. Use the server owner's exact base URL, redirect URI, scopes, and client details when required.
Generate a token from MCP Workspace, then preview the tool inventory. If you see no tools or an authentication error, correct the endpoint or connector before you continue.
MCP Workspace supports DCR for both connection paths when the server supports it. Without DCR, a developer or administrator configures a custom server through an HTTP connector. Neither path grants end users access to the upstream system.
## Verify Authentication
For a custom server that does not support DCR, configure the required OAuth 2.1 connection through an [HTTP connector](/agent-studio/connectors/http-connectors). Then generate a token in MCP Workspace and select **Preview Tools** to verify that the administrator connection can authenticate and retrieve the expected inventory.
Preview Tools validates the administrator connection. It does not guarantee that every user will see the same tool inventory. MCP Workspace retrieves tools for each user at runtime based on that user's upstream permissions.
## Publish, Enable, and Set the Audience
After you verify the server, publish your changes. The **Enabled** toggle turns an MCP server on or off. [Launch Configuration](/agent-studio/access-control/end-user-access-control/launch-configuration) controls which users can reach an enabled server. Start with a defined pilot audience instead of launching a new server broadly.
MCP Workspace controls access at the server level. You cannot allow or block individual tools inside a server. Review the full tool inventory before you enable the server, especially when it exposes write actions.
MCP tools run in the Universal Assistant. Specialized Assistant support is not available during Controlled Availability.
Connecting a server does not grant access to its upstream system. Each user can use only the tools and data that the server and upstream system allow for that user.
## What Users Do the First Time
The first time a user asks the assistant to use a connected app, the assistant prompts that user to sign in within the conversation. After they complete sign-in, later requests can use the server without prompting again.
If a server works for some users but not others, check whether the affected users have completed this first-time authentication. Use [Limitations and Troubleshooting](/agent-studio/mcp-workspace/limitations-and-troubleshooting) when sign-in or a later request fails.