diff --git a/content/docs/cli/automation/ci-integration.mdx b/content/docs/cli/automation/ci-integration.mdx index 4d50f55..eb6a961 100644 --- a/content/docs/cli/automation/ci-integration.mdx +++ b/content/docs/cli/automation/ci-integration.mdx @@ -44,7 +44,7 @@ jobs: steps: - name: Install mogplex CLI run: | - curl -fsSL https://install.mogplex.com/install.sh | sh + curl -fsSL https://mogplex.com/install.sh | sh mogplex --help | head -1 - name: Start cleanup run diff --git a/content/docs/configure-and-extend/connections-and-mcp.mdx b/content/docs/configure-and-extend/connections-and-mcp.mdx index 9e8e226..b42f16f 100644 --- a/content/docs/configure-and-extend/connections-and-mcp.mdx +++ b/content/docs/configure-and-extend/connections-and-mcp.mdx @@ -135,10 +135,40 @@ Mogplex supports two connection categories: | REST API | Base URL plus optional auth | A typed external HTTP tool surface. | | MCP Server | MCP URL or command plus auth material | Tools exposed by the MCP server. | -Manual auth modes include none, API key, bearer token, basic auth, and OAuth. +Manual auth modes include none, API key, bearer token, basic auth, and OAuth +with your own client settings. MCP servers can also use OAuth browser sign-in, +described below. Connection credentials are stored server-side and resolved only when the connection is tested, listed for CLI sync, or used by a run. +### Sign in to an MCP server through the browser + +In the **Integrations** tab, choose **OAuth (browser sign-in)** in the custom +connection form when you add an MCP server that signs users in with OAuth. Enter only the server's MCP URL. After you select **Add and sign +in**, Mogplex sends you to the server's sign-in page and returns you to +Connections when you approve access. + +Mogplex follows the MCP authorization spec, so you do not need to register an +app with the provider first: + +- Mogplex reads the server's protected-resource metadata to find its + authorization server. +- Mogplex registers itself as a client with that server. +- Every sign-in uses PKCE, and the token is issued for that MCP server only. + +The server chooses which authorization server Mogplex sends you to. Before you +approve, confirm the sign-in page belongs to the provider you expect. + +If the provider gave you a client ID or fixed endpoints, you can enter them from +the connections pane instead. Mogplex refreshes the token when it expires. If +the provider revokes access, select **Reconnect** to sign in again. + +The Mogplex CLI uses the connection after you sign in on the web. See +[CLI sync](#cli-sync). The CLI cannot yet start this sign-in by itself. + +OAuth for a REST API connection still needs the client ID, client secret, +authorize URL, and token URL from the provider. + ## Quick-add presets Connections includes MCP presets for common tool providers: @@ -267,13 +297,14 @@ connections. Read [Connection Scope and Overrides](/web/guides/connection-scope-and-overrides) for the full operating model. -## MCP limits +## Keep the tool surface focused -Mogplex caps enabled MCP server connections from **Integrations** at five per resolved scope. -The **MCP Servers** catalog has no server-count cap. - -The cap protects runs from receiving an oversized or noisy tool surface. If a -repo reaches the cap, decide whether to: +Mogplex does not limit how many MCP servers you connect. Each enabled server +that a run's surface loads adds tools that the agent must choose from. See +[Where connection tools load](#where-connection-tools-load) for which surfaces +load which servers. Remote servers also share Control's startup deadline, and a +server that misses it is left out of that turn. If a repo loads tools that it +does not need: - disable a connection - exclude a global MCP from that repo @@ -302,6 +333,12 @@ On startup, the CLI can use the remote list, the cache, or no cloud MCP list if there is no token and no cache. A network or auth failure can fall back to the cache so existing local work is not blocked by a transient catalog fetch issue. +The same response also carries your enabled MCP connections from the +**Integrations** tab, as MCP config. If a saved server and a connection share a +name, the saved server wins. A connection that you signed in to through the +browser arrives with a current access token. Mogplex refreshes that token, so +the CLI does not need its own sign-in. + Use `/mcp` in the CLI to inspect MCP state during a session. ## Security notes @@ -323,7 +360,7 @@ Use `/mcp` in the CLI to inspect MCP state during a session. | Integration tool missing in a hosted run | Confirm the connection is enabled and included in the repo's resolved set. | | Saved MCP tool missing in web chat | Confirm the URL is public and the server supports Streamable HTTP. Choose Test connection, then check the result and each tool's permission. Enable the server to use its allowed tools. A server that misses the startup deadline stays out of that turn, even when an earlier test succeeded. | | Saved MCP tool needs approval | Use Control for tools set to Ask in Control (`prompt` in Extra JSON). Other hosted chat surfaces withhold them. | -| Integration tool works globally but not in one repo | Check for a project exclusion or a project-specific connection cap. | +| Integration tool works globally but not in one repo | Check for a project exclusion, or a connection that is not enabled in that repo. | | CLI does not show cloud MCP servers | Confirm CLI token login, then inspect `/mcp` and the remote cache file. | | OAuth preset stopped working | Reconnect it from Connections and retest before changing prompts. | | MCP response leaks secrets in logs | Rotate the exposed credential and stop logging MCP config output. | diff --git a/content/docs/web/guides/connection-scope-and-overrides.mdx b/content/docs/web/guides/connection-scope-and-overrides.mdx index a3819a9..6d1ee39 100644 --- a/content/docs/web/guides/connection-scope-and-overrides.mdx +++ b/content/docs/web/guides/connection-scope-and-overrides.mdx @@ -59,11 +59,12 @@ this sequence: That resolved set is what the active repo can actually use. -This matters most for MCP servers. The MCP limit is enforced against the -**resolved runnable set for that repo**, not just the raw account-wide list. +This matters most for MCP servers. Mogplex does not limit how many you +connect, but every server in the **resolved runnable set for that repo** adds +tools the agent must choose from. So if one repo is already dense with project MCPs, excluding a noisy global MCP -can be the difference between a clean tool surface and an overstuffed one. +keeps that repo's tool surface small. ## Choose Global vs Project on purpose diff --git a/content/docs/web/settings.mdx b/content/docs/web/settings.mdx index ca911be..cf573e4 100644 --- a/content/docs/web/settings.mdx +++ b/content/docs/web/settings.mdx @@ -208,7 +208,8 @@ The Integrations tab supports: - quick-add MCP presets - fully custom REST or MCP endpoints -- auth modes including none, bearer token, API key, basic auth, and OAuth +- auth modes including none, bearer token, API key, basic auth, OAuth, and + OAuth browser sign-in for MCP servers - testing a connection after setup - enable, disable, reconnect, or remove actions