Requirements and Limits

MCP Workspace connects to remote MCP servers over Streamable HTTP and calls their tools from the Universal Assistant. Check these requirements before you connect a server, and plan your pilot around the current limits.

Current Limitations

Timeouts, Progress, and Retries

Tool calls time out after 120 seconds. The upstream server can set a shorter limit, so test your slowest requests against your server before rollout.

Users do not see the server’s MCP progress updates. A call can continue in the background, but this does not provide a stream of partial results to the employee.

Automatic retries cover certain connection failures before a tool call starts. Failed tool calls are not automatically replayed. A resumed SSE connection also does not mean that the tool ran again.

For a slow or failed request:

1. Open the MCP tool call log and compare its latency and error with the server logs.
2. If the server timed out, reduce the request scope or improve the server’s response time.
3. Before manually retrying a write, check whether the upstream action completed.

Supported Connections

Servers and Transport

Authentication

Tool Responses

Access, Data, and Testing

What a Server Must Support

Use these requirements to check a server before you connect it, whether a vendor runs it or your own developers built it. Rate My MCP Server tests the transport, OAuth metadata, PKCE, and client registration for you.

Endpoint

The server needs a stable Streamable HTTP endpoint over HTTPS with a publicly trusted certificate. Enter its base URL and path separately when you connect a custom server.

OAuth Discovery and DCR

For MCP Workspace to discover the server’s OAuth settings and register a client with Dynamic Client Registration (DCR), the server and its authorization server need:

• Protected Resource Metadata that points to the correct authorization server. Serve it at the RFC 9728 well-known URI, or return its URL in the resource_metadata parameter of a WWW-Authenticate header on 401 Unauthorized.
• Authorization-server metadata, published as OAuth Authorization Server Metadata or OpenID Connect Discovery, that advertises the authorization and token endpoints, S256 PKCE support, and a DCR registration_endpoint.
• Support for the RFC 8707 resource parameter in authorization and token requests, with the access token issued for the canonical MCP server URI.
• 401 Unauthorized when a token is missing, expired, invalid, or issued for a different audience, and 403 Forbidden when a valid token lacks the required scope.

The registration endpoint is not a discovery URL. If the server does not support DCR, configure its authentication through an HTTP connector instead. See Connect a Custom Server.

Tool Results

MCP Workspace currently reads content text blocks. It does not read structuredContent or non-text content blocks, so put every fact the answer needs in text, including source titles and URLs.

{
  "content": [
    {
      "type": "text",
      "text": "Acme PPO is active from 2026-01-01 and covers preventive care and urgent care. Source: [Acme PPO policy](https://benefits.example.com/policies/acme-ppo)."
    }
  ]
}

Return an expected failure as a tool result with isError: true. Start the message with a stable error code and include an opaque request ID for support.

{
  "content": [
    {
      "type": "text",
      "text": "NO_ACTIVE_BENEFIT: No active medical plan was found. Request ID: req_01JZ8Y7QW2."
    }
  ],
  "isError": true
}

Return the answer the employee needs, not raw API responses or hundreds of records for the model to filter. Test the server with the MCP Inspector before you connect it.

Who Owns What

Connecting a server does not transfer responsibility for that server to Moveworks.