MCP Workspace | Moveworks

Controlled Availability

MCP Workspace is available to a limited set of customers. Moveworks is validating the experience and gathering feedback, so capabilities and limits may change. To request access, register your interest.

MCP Workspace is where an Agent Studio admin connects and governs MCP servers. The MCP client is the runtime that lets the Moveworks assistant discover and call those servers’ tools in a conversation, using the credentials configured for that connection.

Connect and manage servers

Connect a preconfigured or custom server, verify its authentication, and make it available to a pilot.

Configure and test MCP Workspace

Reduce tool overlap, test the server with a pilot, and decide when to expand access.

View MCP tool call logs

Inspect tool arguments, model-visible responses, execution status, latency, and errors.

Limitations and troubleshooting

Plan around current CA limits and work through a failed request stage by stage.

Build a custom MCP server

Prepare a private server for MCP Workspace without turning it into a full plugin workflow.

What MCP changes

Before MCP, adding a new system often meant building and maintaining an Agent Studio plugin for a specific use case. With MCP Workspace, an admin can connect a trusted remote server that already exposes the tools the assistant needs.

The server still defines its tools and enforces access. MCP Workspace gives you a place to connect the server, review its tool inventory, and control which users can reach it.

This helps with two common problems:

Coverage limited by development capacity: You can connect a new system when it already exposes an MCP server, without first building a plugin for every bounded use case.
Server sprawl without control: Admins have one place to review, enable, and scope access to each connected server.

How it works

An admin connects an MCP server with its endpoint and authentication configuration.
MCP Workspace retrieves the server’s tool inventory.
A user asks for help in a conversation. The assistant selects a relevant tool and calls it with the connection’s configured access.
The tool result returns in the conversation.

Where MCP fits

MCP is one of several ways to connect the assistant to your systems.

Use	Choose
Find or research content across files and knowledge sources	Enterprise Search
Run a controlled, organization-specific business process	Agent Studio plugin
Run a live lookup or standard action against a trusted external tool	MCP Workspace

MCP Workspace or an Agent Studio plugin?

Use MCP Workspace when a trusted server already exposes a bounded action or live lookup. Use an Agent Studio plugin when you need to control the business rules, systems, and conversation design for a mission-critical workflow.

Use MCP Workspace when	Use an Agent Studio plugin when
The server already exposes the tool you need.	You need organization-specific actions or business rules.
The request is a lookup, read, or standard write.	The workflow is mission-critical, multi-step, or needs predictable orchestration.
You can accept the server’s tool surface and behavior.	You need control of inputs, validation, outputs, and lifecycle.

For example, use MCP Workspace to create a Linear issue, look up a GitHub pull request, or fetch a Slack thread. Use a plugin for a workflow such as new-hire onboarding that coordinates several internal systems and your own process rules.

Common MCP Use Cases

MCP Workspace works best for bounded, transactional work against a connected app.

Work type	Example
Lookup	Check open GitHub pull requests or the current ServiceNow incident owner.
Standard action	Create a Linear issue or post a Slack update.
Bulk action	Add a comment to a clearly scoped set of issues.
Multi-app work	Read action items from one app, then create tasks in another after you state each step.

For bulk actions and multi-app work, be explicit about the scope and steps. The assistant does not automatically compose a complex workflow from a vague goal.

Start with a pilot

Start with a server for a new app or use case, a small pilot audience, and a few clear requests. That gives you a clean way to validate tool selection, authentication, and results before the server competes with the rest of your tool environment.

Use Connect and Manage Servers to set up the server, then Configure and Test MCP Workspace to configure and validate the pilot.

Common Questions

Connection Compatibility

Question	Answer
Does Agent Studio connect to MCP servers directly?	Yes. MCP Workspace discovers and calls a remote server’s tools without a separate HTTP action for each tool.
Which transports and response types work?	Use Streamable HTTP. The client accepts both `application/json` and `text/event-stream` (SSE) responses. Local `stdio` and the legacy two-endpoint HTTP+SSE transport are not supported by this connection path.
Which MCP protocol versions can the client negotiate?	`2024-11-05`, `2025-03-26`, `2025-06-18`, and `2025-11-25`. Protocol version and transport are separate choices. Streamable HTTP replaced the older HTTP+SSE transport in the `2025-03-26` specification.
Does Moveworks handle the MCP handshake and session ID?	Yes. The client sends `initialize`, `notifications/initialized`, and tool requests. It sends `Mcp-Session-Id` on later requests within that connection. Each operation opens a fresh connection.
Does a session error restart the failed call?	No. An HTTP `400` or `404` fails the call. Moveworks does not automatically initialize a new session and replay that failed tool call.
Can each employee sign in with their own Microsoft Entra ID account?	Yes. Use Authorization Code with SHA256 PKCE and the scopes required by your server. If the provider issued a valid refresh token, Moveworks refreshes stored user tokens when needed. Use the manual OAuth setup when DCR is unavailable.
Is Entra on-behalf-of authentication supported?	An on-behalf-of token exchange is not built into this MCP connection path. Use per-user Authorization Code with PKCE for delegated access.
Can I use application credentials instead of user sign-in?	Yes. Client Credentials authenticates the application. It does not identify the employee, and Moveworks does not automatically attach the employee’s UPN or email to the request.
Can I add custom headers or fix tool arguments?	Static connector headers are supported with application-level authentication. Custom per-user headers are not supported in this path. Moveworks sets the MCP `Accept` header. Keep fixed arguments in the server and expose only the inputs the assistant needs.
Can a retrieval take 120 seconds?	Long-running calls are supported. A 120-second retrieval fits within current timeout budgets, but test it with your server before rollout. Timeouts, progress, and retries explains the limits.
What network access does the server need?	Use HTTPS with a publicly trusted certificate. Get your organization’s egress IPs from Setup > Organization Details > General Information > Network Details. Some environments use dynamic IPs. Network Allowlisting explains the network settings.
How are tokens and tool-call data stored?	Access and refresh tokens are encrypted before storage. Logs can include arguments, the model-visible response, status, latency, and errors. Standard and Strict Redaction control visible values. Default system-log retention is two weeks. Log Data Security explains the policies.
What should a tool return for an answer with source links?	Put the answer, source title, and URL in `content` text blocks. MCP Workspace currently reads text blocks, not `structuredContent` or non-text blocks. Response examples show the format.
What happens when a tool fails or returns a large result?	The assistant receives tool errors. There is no fixed fallback answer. Keep results focused. Size handling depends on the execution path. The 32 KB limit on log fields is not a maximum tool-response size.
How do I keep a search tool from competing with Enterprise Search?	Give the server and tool a clear scope. Pilot requests that name the app, such as “Search Acme Research for the latest policy.” Test tool selection with Enterprise Search enabled before rollout.
Can I restrict access to a pilot group?	Yes. Launch Configuration controls the server’s audience. The server’s Enabled toggle controls whether it is available.
Can I test MCP in a sandbox tenant?	Use your organization’s existing test environment. Connecting a server does not create a sandbox. Your Moveworks administrator or account team can confirm which test environments are available to your organization.

Which servers can I connect?

You can connect compatible remote MCP servers. Both preconfigured and custom server paths support DCR when the server supports it. If a custom server does not support DCR, configure its authentication through an HTTP connector. Local MCP servers are not supported.

Whose permissions apply when a tool runs?

For per-user authorization, the user’s upstream permissions apply. Application credentials use the application’s permissions. Connecting a server does not change upstream permissions.

How is data handled?

Standard log redaction for personally identifiable information and credentials applies to MCP activity. Configure data handling for each server in Launch Configuration, as you would for an Agent Studio plugin.

Can I govern individual tools inside a server?

No. Governance is server-level during Controlled Availability. You enable, disable, and set access for the whole server.

Can MCP handle multi-app or bulk work?

Yes, when the request names the apps, scope, and each intended step. Review write-capable servers and set the tool approval policy before rollout.

How do I confirm that an MCP tool ran?

Open More info > Reveal AI Reasoning on a response and look for a tool call in the format mcp__<server>__<tool>. Use Chat Playback to review selection and MCP tool call logs for arguments, results, status, and latency. There is no dedicated MCP analytics dashboard.

Why can Preview Tools work while an employee's request fails?

Preview Tools validates the administrator connection. It does not prove that every employee can use the server. Check the server’s enabled state, pilot audience, and the employee’s upstream permissions and sign-in. Use the troubleshooting stages to separate access, authentication, selection, and execution failures.

Why does DCR fail when my server supports client registration?

DCR requires OAuth discovery metadata as well as a registration endpoint. Do not substitute the registration endpoint for the MCP endpoint or OAuth discovery URL. Check the discovery requirements, or use the manual HTTP connector path.

How do users reconnect after a token expires?

Moveworks attempts token refresh when needed. If authorization is required, a request that names the app can prompt the user to connect again. A reconnect prompt is not guaranteed for every upstream 401. If the connection still appears authorized, follow the authentication recovery steps.