Skip to content

docs: browser sign-in for custom MCP servers, no MCP server limit, one install URL #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
charlesrhoward merged 3 commits into from
Nov 9, 2026
Merged

docs: browser sign-in for custom MCP servers, no MCP server limit, one install URL #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a966505
docs: browser sign-in for custom MCP servers, no MCP server limit, on…
charlesrhoward Nov 9, 2026
11362ef
docs: drop remaining MCP cap wording and scope the tool-load claim
charlesrhoward Nov 9, 2026
18f5173
docs: describe how browser-signed-in MCP connections reach the CLI
charlesrhoward Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/docs/cli/automation/ci-integration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
steps:
- name: Install mogplex CLI
run: |
curl -fsSL https://install.mogplex.com/install.sh | sh
curl -fsSL https://mogplex.com/install.sh | sh
mogplex --help | head -1

- name: Start cleanup run
Expand Down
53 changes: 45 additions & 8 deletions content/docs/configure-and-extend/connections-and-mcp.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,10 +135,40 @@ Mogplex supports two connection categories:
| REST API | Base URL plus optional auth | A typed external HTTP tool surface. |
| MCP Server | MCP URL or command plus auth material | Tools exposed by the MCP server. |

Manual auth modes include none, API key, bearer token, basic auth, and OAuth.
Manual auth modes include none, API key, bearer token, basic auth, and OAuth
with your own client settings. MCP servers can also use OAuth browser sign-in,
described below.
Connection credentials are stored server-side and resolved only when the
connection is tested, listed for CLI sync, or used by a run.

### Sign in to an MCP server through the browser

@mogplex mogplex Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Name the tab in the browser sign-in instructions

The text reads "Choose OAuth (browser sign-in) when you add an MCP server that signs users in with OAuth" without saying which surface it happens on.

The page documents two different add flows: the Integrations custom connection form, which is where the auth-mode list appears immediately above at L138, and the separate MCP Servers tab.

The MCP Servers flow in "Use a saved server in web chat" is documented as Add server / Streamable HTTP / headers / Enabled, with no OAuth option, so a reader coming from that tab will look for a control that may not exist there.

Saying "In the Integrations tab, choose OAuth (browser sign-in)" makes it unambiguous.

That wording also matches content/docs/web/settings.mdx L208-L212 in this same PR, which lists "OAuth browser sign-in for MCP servers" as an Integrations-tab auth mode.

If the flow is also available for saved servers, the saved-server section needs a matching sentence.


In the **Integrations** tab, choose **OAuth (browser sign-in)** in the custom
connection form when you add an MCP server that signs users in with OAuth. Enter only the server's MCP URL. After you select **Add and sign
in**, Mogplex sends you to the server's sign-in page and returns you to
Connections when you approve access.

Mogplex follows the MCP authorization spec, so you do not need to register an
app with the provider first:

@mogplex mogplex Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: New browser sign-in section would benefit from a "verify the sign-in domain" line

The section explains that the MCP server's protected-resource metadata decides which authorization server you get sent to and that Mogplex registers itself there automatically. That is correct, but it also means the destination of the sign-in page is chosen by the server, not by the user, and credentials are then typed into that page.

Existing Security notes on this page cover treating MCP config as .env-like, but nothing tells the reader to confirm the domain on the consent screen before approving. Suggestion: add one sentence, such as "Before you approve, confirm the sign-in page is the provider you expect; the server chooses which authorization server Mogplex uses."


- Mogplex reads the server's protected-resource metadata to find its
authorization server.
- Mogplex registers itself as a client with that server.
- Every sign-in uses PKCE, and the token is issued for that MCP server only.

The server chooses which authorization server Mogplex sends you to. Before you
approve, confirm the sign-in page belongs to the provider you expect.

If the provider gave you a client ID or fixed endpoints, you can enter them from
the connections pane instead. Mogplex refreshes the token when it expires. If
the provider revokes access, select **Reconnect** to sign in again.

The Mogplex CLI uses the connection after you sign in on the web. See
[CLI sync](#cli-sync). The CLI cannot yet start this sign-in by itself.

OAuth for a REST API connection still needs the client ID, client secret,
authorize URL, and token URL from the provider.

## Quick-add presets

Connections includes MCP presets for common tool providers:
Expand Down Expand Up @@ -267,13 +297,14 @@ connections.
Read [Connection Scope and Overrides](/web/guides/connection-scope-and-overrides)
for the full operating model.

## MCP limits
## Keep the tool surface focused

@mogplex mogplex Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Heading rename drops the #mcp-limits anchor

Renaming "MCP limits" to "Keep the tool surface focused" removes the #mcp-limits anchor.

No inbound links to it were found in web/settings.mdx, web/guides/connection-scope-and-overrides.mdx, guides/troubleshooting.mdx, support.mdx, reference/glossary.mdx, plans-and-billing.mdx, index.mdx, guides/common-use-cases.mdx, or the CLI pages.

CI runs only lint, typecheck, test, and build, so a stale anchor elsewhere would not fail the build.

Worth a repo-wide grep for mcp-limits before merge, since the rename is otherwise invisible to CI.


Mogplex caps enabled MCP server connections from **Integrations** at five per resolved scope.
The **MCP Servers** catalog has no server-count cap.

The cap protects runs from receiving an oversized or noisy tool surface. If a
repo reaches the cap, decide whether to:
Mogplex does not limit how many MCP servers you connect. Each enabled server

@mogplex mogplex Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Removing the cap leaves the per-turn startup budget unexplained

"Mogplex does not limit how many MCP servers you connect. Each enabled server that a run's surface loads adds tools that the agent must choose from." drops the previous explanation of why the cap existed, namely that an oversized surface is what actually hurts runs.

The page already documents the mechanism that bites first: "Control waits up to eight seconds for remote MCP servers" and "A server that misses that deadline is left out", in Where connection tools load and in the Saved MCP tool troubleshooting row.

With no server cap, nothing connects the new advice to that behaviour.

A reader who adds many remote servers can therefore see tools silently disappear from a turn and have no stated reason why.

One sentence pointing at that deadline would close the gap.

that a run's surface loads adds tools that the agent must choose from. See
[Where connection tools load](#where-connection-tools-load) for which surfaces
load which servers. Remote servers also share Control's startup deadline, and a
server that misses it is left out of that turn. If a repo loads tools that it
does not need:

- disable a connection
- exclude a global MCP from that repo
Expand Down Expand Up @@ -302,6 +333,12 @@ On startup, the CLI can use the remote list, the cache, or no cloud MCP list if
there is no token and no cache. A network or auth failure can fall back to the
cache so existing local work is not blocked by a transient catalog fetch issue.

The same response also carries your enabled MCP connections from the
**Integrations** tab, as MCP config. If a saved server and a connection share a
name, the saved server wins. A connection that you signed in to through the
browser arrives with a current access token. Mogplex refreshes that token, so
the CLI does not need its own sign-in.

Use `/mcp` in the CLI to inspect MCP state during a session.

## Security notes
Expand All @@ -323,7 +360,7 @@ Use `/mcp` in the CLI to inspect MCP state during a session.
| Integration tool missing in a hosted run | Confirm the connection is enabled and included in the repo's resolved set. |
| Saved MCP tool missing in web chat | Confirm the URL is public and the server supports Streamable HTTP. Choose Test connection, then check the result and each tool's permission. Enable the server to use its allowed tools. A server that misses the startup deadline stays out of that turn, even when an earlier test succeeded. |
| Saved MCP tool needs approval | Use Control for tools set to Ask in Control (`prompt` in Extra JSON). Other hosted chat surfaces withhold them. |
| Integration tool works globally but not in one repo | Check for a project exclusion or a project-specific connection cap. |
| Integration tool works globally but not in one repo | Check for a project exclusion, or a connection that is not enabled in that repo. |
| CLI does not show cloud MCP servers | Confirm CLI token login, then inspect `/mcp` and the remote cache file. |
| OAuth preset stopped working | Reconnect it from Connections and retest before changing prompts. |
| MCP response leaks secrets in logs | Rotate the exposed credential and stop logging MCP config output. |
Expand Down
7 changes: 4 additions & 3 deletions content/docs/web/guides/connection-scope-and-overrides.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,11 +59,12 @@ this sequence:

That resolved set is what the active repo can actually use.

This matters most for MCP servers. The MCP limit is enforced against the
**resolved runnable set for that repo**, not just the raw account-wide list.
This matters most for MCP servers. Mogplex does not limit how many you
connect, but every server in the **resolved runnable set for that repo** adds
tools the agent must choose from.

So if one repo is already dense with project MCPs, excluding a noisy global MCP
can be the difference between a clean tool surface and an overstuffed one.
keeps that repo's tool surface small.

## Choose Global vs Project on purpose

Expand Down
3 changes: 2 additions & 1 deletion content/docs/web/settings.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,8 @@ The Integrations tab supports:

- quick-add MCP presets
- fully custom REST or MCP endpoints
- auth modes including none, bearer token, API key, basic auth, and OAuth
- auth modes including none, bearer token, API key, basic auth, OAuth, and
OAuth browser sign-in for MCP servers
- testing a connection after setup
- enable, disable, reconnect, or remove actions

Expand Down
Loading