> This page is for Tools. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # Requirements and Limits > **Controlled Availability** > > MCP Workspace is available to a limited set of customers. Moveworks is validating the experience and gathering feedback, so capabilities and limits may change. To request access, [register your interest](https://community.moveworks.com/p/mcp-workspace-controlled-availability). MCP Workspace connects to remote MCP servers over Streamable HTTP and calls their tools from the Universal Assistant. Check these requirements before you connect a server, and plan your pilot around the current limits. ## Current Limitations | Limitation | What it means | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Universal Assistant only | MCP tools run in the Universal Assistant. Productivity Assistant support is not available during Controlled Availability. | | Governance is server-level | You can enable, disable, and control access to a server, not individual tools within it. | | Approval policy applies to the server | Set the [tool approval policy](/tool-studio/mcp-workspace/connect-a-server#set-the-tool-approval-policy) before enabling write-capable tools. | | No automatic action chaining across MCP servers | Name the apps and each intended step. The assistant does not automatically compose a complex cross-app workflow from a vague goal. | | Tool calls time out after 120 seconds | The upstream server can set a shorter limit. Test the slowest requests in your pilot. | | Tool descriptions control routing quality | Tool names and descriptions come from the server. You cannot edit them in Tool Studio, so improve them at the source when you can. | | Servers are added manually | MCP Workspace does not sync a catalog from an MCP registry or aggregator. | | Tools only | Resources, Prompts, and Sampling are not supported. Moveworks connects to remote MCP servers, not local servers. | ## Timeouts, Progress, and Retries Tool calls time out after 120 seconds. The upstream server can set a shorter limit, so test your slowest requests against your server before rollout. Users do not see the server's MCP progress updates. A call can continue in the background, but this does not provide a stream of partial results to the employee. Automatic retries cover certain connection failures before a tool call starts. Failed tool calls are not automatically replayed. A resumed SSE connection also does not mean that the tool ran again. For a slow or failed request: 1. Open the [MCP tool call log](/tool-studio/mcp-workspace/troubleshooting#find-the-mcp-tool-call-log) and compare its latency and error with the server logs. 2. If the server timed out, reduce the request scope or improve the server's response time. 3. Before manually retrying a write, check whether the upstream action completed. ## Supported Connections ### Servers and Transport | Question | Answer | | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Which servers can I connect? | You can connect compatible remote MCP servers. Both preconfigured and custom server paths support DCR when the server supports it. If a custom server does not support DCR, configure its authentication through an HTTP connector. Local MCP servers are not supported. | | Does Tool Studio connect to MCP servers directly? | Yes. MCP Workspace discovers and calls a remote server's tools without a separate HTTP action for each tool. | | Which transports and response types work? | Use Streamable HTTP. The client accepts both `application/json` and `text/event-stream` (SSE) responses. Local `stdio` and the legacy two-endpoint HTTP+SSE transport are not supported by this connection path. | | Which MCP protocol versions can the client negotiate? | `2024-11-05`, `2025-03-26`, `2025-06-18`, and `2025-11-25`. Protocol version and transport are separate choices. Streamable HTTP replaced the older HTTP+SSE transport in the `2025-03-26` specification. | | Does Moveworks handle the MCP handshake and session ID? | Yes. The client sends `initialize`, `notifications/initialized`, and tool requests. It sends `Mcp-Session-Id` on later requests within that connection. Each operation opens a fresh connection. | | Does a session error restart the failed call? | No. An HTTP `400` or `404` fails the call. Moveworks does not automatically initialize a new session and replay that failed tool call. | | What network access does the server need? | Use HTTPS with a publicly trusted certificate. Get your organization's egress IPs from **Setup > Organization Details > General Information > Network Details**. Some environments use dynamic IPs. [Network Allowlisting](/tool-studio/connectors/ip-address-allowlisting) explains the network settings. | ### Authentication | Question | Answer | | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Can each employee sign in with their own Microsoft Entra ID account? | Yes. Use Authorization Code with SHA256 PKCE and the scopes required by your server. If the provider issued a valid refresh token, Moveworks refreshes stored user tokens when needed. Use the [manual OAuth setup](/tool-studio/mcp-workspace/connect-a-server#connect-a-custom-server) when DCR is unavailable. | | Is Entra on-behalf-of authentication supported? | An on-behalf-of token exchange is not built into this MCP connection path. Use per-user Authorization Code with PKCE for delegated access. | | Can I use application credentials instead of user sign-in? | Yes. Client Credentials authenticates the application. It does not identify the employee, and Moveworks does not automatically attach the employee's UPN or email to the request. | | Can I add custom headers or fix tool arguments? | Static connector headers are supported with application-level authentication. Custom per-user headers are not supported in this path. Moveworks sets the MCP `Accept` header. Keep fixed arguments in the server and expose only the inputs the assistant needs. | ### Tool Responses | Question | Answer | | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | What should a tool return for an answer with source links? | Put the answer, source title, and URL in `content` text blocks. MCP Workspace currently reads text blocks, not `structuredContent` or non-text blocks. [Tool Results](#tool-results) shows the format. | | What happens when a tool fails or returns a large result? | The assistant receives tool errors. There is no fixed fallback answer. Keep results focused. Size handling depends on the execution path. The 32 KB limit on [log fields](/tool-studio/agent-telemetry/logs/log-type-reference#mcptooltrigger) is not a maximum tool-response size. | | How long can a tool call run? | Tool calls time out after 120 seconds. The upstream server can set a shorter limit. [Timeouts, progress, and retries](#timeouts-progress-and-retries) explains what to do when a call is slow. | ### Access, Data, and Testing | Question | Answer | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Whose permissions apply when a tool runs? | For per-user authorization, the user's upstream permissions apply. Application credentials use the application's permissions. Connecting a server does not change upstream permissions. | | Can I restrict access to a pilot group? | Yes. [Launch Configuration](/platform-management/access-control/end-user-access-control/launch-configuration) controls the server's audience. The server's **Enabled** toggle controls whether it is available. | | How are tokens and tool-call data stored? | Access and refresh tokens are encrypted before storage. Logs can include arguments, the model-visible response, status, latency, and errors. Standard and Strict Redaction control visible values. Default system-log retention is two weeks. [Log Data Security](/tool-studio/agent-telemetry/logs/log-redaction) explains the policies. | | How is MCP activity data handled? | Standard log redaction for personally identifiable information and credentials applies to MCP activity. Configure data handling for each server in [Launch Configuration](/platform-management/access-control/end-user-access-control/launch-configuration), as you would for a Tool Studio plugin. | | How do I keep a search tool from competing with Enterprise Search? | Give the server and tool a clear scope. Pilot requests that name the app, such as "Search Acme Research for the latest policy." Test [tool selection](/tool-studio/mcp-workspace/pilot-and-roll-out) with Enterprise Search enabled before rollout. | | Can I test MCP in a sandbox tenant? | Use your organization's existing test environment. Connecting a server does not create a sandbox. Your Moveworks administrator or account team can confirm which test environments are available to your organization. | ## What a Server Must Support Use these requirements to check a server before you connect it, whether a vendor runs it or your own developers built it. [Rate My MCP Server](/tool-studio/mcp-workspace/rate-my-mcp-server) tests the transport, OAuth metadata, PKCE, and client registration for you. ### Endpoint The server needs a stable [Streamable HTTP](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports) endpoint over HTTPS with a publicly trusted certificate. Enter its base URL and path separately when you [connect a custom server](/tool-studio/mcp-workspace/connect-a-server#connect-a-custom-server). ### OAuth Discovery and DCR For MCP Workspace to discover the server's OAuth settings and register a client with Dynamic Client Registration (DCR), the server and its authorization server need: * [Protected Resource Metadata](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) that points to the correct authorization server. Serve it at the RFC 9728 well-known URI, or return its URL in the `resource_metadata` parameter of a `WWW-Authenticate` header on `401 Unauthorized`. * Authorization-server metadata, published as OAuth Authorization Server Metadata or OpenID Connect Discovery, that advertises the authorization and token endpoints, `S256` PKCE support, and a DCR `registration_endpoint`. * Support for the RFC 8707 `resource` parameter in authorization and token requests, with the access token issued for the canonical MCP server URI. * `401 Unauthorized` when a token is missing, expired, invalid, or issued for a different audience, and `403 Forbidden` when a valid token lacks the required scope. The registration endpoint is not a discovery URL. If the server does not support DCR, configure its authentication through an HTTP connector instead. See [Connect a Custom Server](/tool-studio/mcp-workspace/connect-a-server#connect-a-custom-server). ### Tool Results MCP Workspace currently reads `content` text blocks. It does not read `structuredContent` or non-text content blocks, so put every fact the answer needs in text, including source titles and URLs. **`Tool result with an answer and a source link`** ```json title="Tool result with an answer and a source link" { "content": [ { "type": "text", "text": "Acme PPO is active from 2026-01-01 and covers preventive care and urgent care. Source: [Acme PPO policy](https://benefits.example.com/policies/acme-ppo)." } ] } ``` Return an expected failure as a tool result with `isError: true`. Start the message with a stable error code and include an opaque request ID for support. **`Expected tool error`** ```json title="Expected tool error" { "content": [ { "type": "text", "text": "NO_ACTIVE_BENEFIT: No active medical plan was found. Request ID: req_01JZ8Y7QW2." } ], "isError": true } ``` Return the answer the employee needs, not raw API responses or hundreds of records for the model to filter. Test the server with the [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) before you connect it. ## Who Owns What Connecting a server does not transfer responsibility for that server to Moveworks. | Owner | Responsibilities | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Server owner | Operate the endpoint and authorization server; validate tokens; enforce entitlements; maintain tool schemas and descriptions; handle upstream dependencies; and provide request IDs and server-side logs. | | Customer administrator | Configure the server or HTTP connector in MCP Workspace; review the exposed tools; enable the server; set its audience in Launch Configuration; and provide conversation evidence when escalating. | | Moveworks | Operate MCP Workspace and the MCP client; diagnose product-side connection, discovery, routing, and execution behavior; and document current product constraints. Moveworks does not review or certify private servers. |