From a966505746c1dbede17dd9cd586ad0c22d4e4fc5 Mon Sep 17 00:00:00 2001 From: Charles Howard <96023061+charlesrhoward@users.noreply.github.com> Date: Sun, 8 Nov 2026 20:54:57 -0500 Subject: [PATCH 1/3] docs: browser sign-in for custom MCP servers, no MCP server limit, one install URL --- .../docs/cli/automation/ci-integration.mdx | 2 +- .../connections-and-mcp.mdx | 39 ++++++++++++++++--- 2 files changed, 34 insertions(+), 7 deletions(-) diff --git a/content/docs/cli/automation/ci-integration.mdx b/content/docs/cli/automation/ci-integration.mdx index 4d50f55..eb6a961 100644 --- a/content/docs/cli/automation/ci-integration.mdx +++ b/content/docs/cli/automation/ci-integration.mdx @@ -44,7 +44,7 @@ jobs: steps: - name: Install mogplex CLI run: | - curl -fsSL https://install.mogplex.com/install.sh | sh + curl -fsSL https://mogplex.com/install.sh | sh mogplex --help | head -1 - name: Start cleanup run diff --git a/content/docs/configure-and-extend/connections-and-mcp.mdx b/content/docs/configure-and-extend/connections-and-mcp.mdx index 9e8e226..b396327 100644 --- a/content/docs/configure-and-extend/connections-and-mcp.mdx +++ b/content/docs/configure-and-extend/connections-and-mcp.mdx @@ -139,6 +139,31 @@ Manual auth modes include none, API key, bearer token, basic auth, and OAuth. Connection credentials are stored server-side and resolved only when the connection is tested, listed for CLI sync, or used by a run. +### Sign in to an MCP server through the browser + +Choose **OAuth (browser sign-in)** when you add an MCP server that signs users +in with OAuth. Enter only the server's MCP URL. After you select **Add and sign +in**, Mogplex sends you to the server's sign-in page and returns you to +Connections when you approve access. + +Mogplex follows the MCP authorization spec, so you do not need to register an +app with the provider first: + +- Mogplex reads the server's protected-resource metadata to find its + authorization server. +- Mogplex registers itself as a client with that server. +- Every sign-in uses PKCE, and the token is issued for that MCP server only. + +If the provider gave you a client ID or fixed endpoints, you can enter them from +the connections pane instead. Mogplex refreshes the token when it expires. If +the provider revokes access, select **Reconnect** to sign in again. + +The Mogplex CLI uses the connection after you sign in on the web. See +[CLI sync](#cli-sync). The CLI cannot yet start this sign-in by itself. + +OAuth for a REST API connection still needs the client ID, client secret, +authorize URL, and token URL from the provider. + ## Quick-add presets Connections includes MCP presets for common tool providers: @@ -267,13 +292,12 @@ connections. Read [Connection Scope and Overrides](/web/guides/connection-scope-and-overrides) for the full operating model. -## MCP limits +## Keep the tool surface focused -Mogplex caps enabled MCP server connections from **Integrations** at five per resolved scope. -The **MCP Servers** catalog has no server-count cap. - -The cap protects runs from receiving an oversized or noisy tool surface. If a -repo reaches the cap, decide whether to: +Mogplex does not limit how many MCP servers you connect. Every enabled server +in a repo's resolved set loads into runs for that repo, so each extra server +adds tools that the agent must choose from. If a repo loads tools that it does +not need: - disable a connection - exclude a global MCP from that repo @@ -302,6 +326,9 @@ On startup, the CLI can use the remote list, the cache, or no cloud MCP list if there is no token and no cache. A network or auth failure can fall back to the cache so existing local work is not blocked by a transient catalog fetch issue. +The catalog includes OAuth connections that you signed in to on the web. +Mogplex refreshes their tokens, so the CLI does not need its own sign-in. + Use `/mcp` in the CLI to inspect MCP state during a session. ## Security notes From 11362efb52129142065fe0a5cfe818ba92e48a8c Mon Sep 17 00:00:00 2001 From: Charles Howard <96023061+charlesrhoward@users.noreply.github.com> Date: Sun, 8 Nov 2026 21:44:35 -0500 Subject: [PATCH 2/3] docs: drop remaining MCP cap wording and scope the tool-load claim --- .../configure-and-extend/connections-and-mcp.mdx | 16 +++++++++++----- .../guides/connection-scope-and-overrides.mdx | 7 ++++--- content/docs/web/settings.mdx | 3 ++- 3 files changed, 17 insertions(+), 9 deletions(-) diff --git a/content/docs/configure-and-extend/connections-and-mcp.mdx b/content/docs/configure-and-extend/connections-and-mcp.mdx index b396327..3485893 100644 --- a/content/docs/configure-and-extend/connections-and-mcp.mdx +++ b/content/docs/configure-and-extend/connections-and-mcp.mdx @@ -135,7 +135,9 @@ Mogplex supports two connection categories: | REST API | Base URL plus optional auth | A typed external HTTP tool surface. | | MCP Server | MCP URL or command plus auth material | Tools exposed by the MCP server. | -Manual auth modes include none, API key, bearer token, basic auth, and OAuth. +Manual auth modes include none, API key, bearer token, basic auth, and OAuth +with your own client settings. MCP servers can also use OAuth browser sign-in, +described below. Connection credentials are stored server-side and resolved only when the connection is tested, listed for CLI sync, or used by a run. @@ -154,6 +156,9 @@ app with the provider first: - Mogplex registers itself as a client with that server. - Every sign-in uses PKCE, and the token is issued for that MCP server only. +The server chooses which authorization server Mogplex sends you to. Before you +approve, confirm the sign-in page belongs to the provider you expect. + If the provider gave you a client ID or fixed endpoints, you can enter them from the connections pane instead. Mogplex refreshes the token when it expires. If the provider revokes access, select **Reconnect** to sign in again. @@ -294,9 +299,10 @@ for the full operating model. ## Keep the tool surface focused -Mogplex does not limit how many MCP servers you connect. Every enabled server -in a repo's resolved set loads into runs for that repo, so each extra server -adds tools that the agent must choose from. If a repo loads tools that it does +Mogplex does not limit how many MCP servers you connect. Each enabled server +that a run's surface loads adds tools that the agent must choose from. See +[Where connection tools load](#where-connection-tools-load) for which surfaces +load which servers. If a repo loads tools that it does not need: - disable a connection @@ -350,7 +356,7 @@ Use `/mcp` in the CLI to inspect MCP state during a session. | Integration tool missing in a hosted run | Confirm the connection is enabled and included in the repo's resolved set. | | Saved MCP tool missing in web chat | Confirm the URL is public and the server supports Streamable HTTP. Choose Test connection, then check the result and each tool's permission. Enable the server to use its allowed tools. A server that misses the startup deadline stays out of that turn, even when an earlier test succeeded. | | Saved MCP tool needs approval | Use Control for tools set to Ask in Control (`prompt` in Extra JSON). Other hosted chat surfaces withhold them. | -| Integration tool works globally but not in one repo | Check for a project exclusion or a project-specific connection cap. | +| Integration tool works globally but not in one repo | Check for a project exclusion, or a connection that is not enabled in that repo. | | CLI does not show cloud MCP servers | Confirm CLI token login, then inspect `/mcp` and the remote cache file. | | OAuth preset stopped working | Reconnect it from Connections and retest before changing prompts. | | MCP response leaks secrets in logs | Rotate the exposed credential and stop logging MCP config output. | diff --git a/content/docs/web/guides/connection-scope-and-overrides.mdx b/content/docs/web/guides/connection-scope-and-overrides.mdx index a3819a9..6d1ee39 100644 --- a/content/docs/web/guides/connection-scope-and-overrides.mdx +++ b/content/docs/web/guides/connection-scope-and-overrides.mdx @@ -59,11 +59,12 @@ this sequence: That resolved set is what the active repo can actually use. -This matters most for MCP servers. The MCP limit is enforced against the -**resolved runnable set for that repo**, not just the raw account-wide list. +This matters most for MCP servers. Mogplex does not limit how many you +connect, but every server in the **resolved runnable set for that repo** adds +tools the agent must choose from. So if one repo is already dense with project MCPs, excluding a noisy global MCP -can be the difference between a clean tool surface and an overstuffed one. +keeps that repo's tool surface small. ## Choose Global vs Project on purpose diff --git a/content/docs/web/settings.mdx b/content/docs/web/settings.mdx index ca911be..cf573e4 100644 --- a/content/docs/web/settings.mdx +++ b/content/docs/web/settings.mdx @@ -208,7 +208,8 @@ The Integrations tab supports: - quick-add MCP presets - fully custom REST or MCP endpoints -- auth modes including none, bearer token, API key, basic auth, and OAuth +- auth modes including none, bearer token, API key, basic auth, OAuth, and + OAuth browser sign-in for MCP servers - testing a connection after setup - enable, disable, reconnect, or remove actions From 18f51730ebf187ec3c749e6a400080bd535c02c1 Mon Sep 17 00:00:00 2001 From: Charles Howard <96023061+charlesrhoward@users.noreply.github.com> Date: Sun, 8 Nov 2026 23:37:32 -0500 Subject: [PATCH 3/3] docs: describe how browser-signed-in MCP connections reach the CLI --- .../configure-and-extend/connections-and-mcp.mdx | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/content/docs/configure-and-extend/connections-and-mcp.mdx b/content/docs/configure-and-extend/connections-and-mcp.mdx index 3485893..b42f16f 100644 --- a/content/docs/configure-and-extend/connections-and-mcp.mdx +++ b/content/docs/configure-and-extend/connections-and-mcp.mdx @@ -143,8 +143,8 @@ connection is tested, listed for CLI sync, or used by a run. ### Sign in to an MCP server through the browser -Choose **OAuth (browser sign-in)** when you add an MCP server that signs users -in with OAuth. Enter only the server's MCP URL. After you select **Add and sign +In the **Integrations** tab, choose **OAuth (browser sign-in)** in the custom +connection form when you add an MCP server that signs users in with OAuth. Enter only the server's MCP URL. After you select **Add and sign in**, Mogplex sends you to the server's sign-in page and returns you to Connections when you approve access. @@ -302,8 +302,9 @@ for the full operating model. Mogplex does not limit how many MCP servers you connect. Each enabled server that a run's surface loads adds tools that the agent must choose from. See [Where connection tools load](#where-connection-tools-load) for which surfaces -load which servers. If a repo loads tools that it does -not need: +load which servers. Remote servers also share Control's startup deadline, and a +server that misses it is left out of that turn. If a repo loads tools that it +does not need: - disable a connection - exclude a global MCP from that repo @@ -332,8 +333,11 @@ On startup, the CLI can use the remote list, the cache, or no cloud MCP list if there is no token and no cache. A network or auth failure can fall back to the cache so existing local work is not blocked by a transient catalog fetch issue. -The catalog includes OAuth connections that you signed in to on the web. -Mogplex refreshes their tokens, so the CLI does not need its own sign-in. +The same response also carries your enabled MCP connections from the +**Integrations** tab, as MCP config. If a saved server and a connection share a +name, the saved server wins. A connection that you signed in to through the +browser arrives with a current access token. Mogplex refreshes that token, so +the CLI does not need its own sign-in. Use `/mcp` in the CLI to inspect MCP state during a session.