MCP servers
Give the agent extra tools by connecting Model Context Protocol servers.
The agent has a solid built-in toolset, but you can extend it. Clusy supports MCP, the Model Context Protocol, which is an open standard for exposing tools to an AI. Connect an MCP server and its tools become things the agent can call, alongside its built-in ones.
What it's for
MCP is how you teach the agent to do things specific to your world: query an internal warehouse, hit a private API, or reach a service that isn't built into Clusy. If there's an MCP server for it (and there are many, plus you can write your own), the agent can use it.
Adding a server
Manage servers under Settings → MCP servers. You give the server a name, its URL, and any headers it needs to authenticate you.
Pick Streamable HTTP, not STDIO
The form offers two transports, and only Streamable HTTP works on Clusy cloud. A STDIO server is a local subprocess, which the hosted agent will not spawn (running a command out of a settings field is a remote-execution surface), so STDIO is disabled and available only to self-hosted deployments.
The form still defaults to STDIO, which is a rough edge we haven't fixed yet. A server added that way will save, and will look connected, and its tools will simply never load. Switch the transport to Streamable HTTP before you save.
Once added, you can enable or disable a server without deleting it, and edit it later.
A worked example
GitHub runs a remote MCP server that exposes issues, pull requests, and code search as tools. Connecting it looks like this:
| Field | Value |
|---|---|
| Name | GitHub |
| Transport | Streamable HTTP |
| URL | https://api.githubcopilot.com/mcp/ |
| Custom header | Authorization → Bearer ghp_your_personal_access_token |
The header is the whole of the authentication. Clusy sends it on every request it makes to that server, and the server decides what your token is allowed to see. Scope the token to what you actually want the agent reaching.
Hugging Face runs one at https://huggingface.co/mcp that works the same way, with an optional token header if you want it to see your private repos.
Where a server runs
Worth being explicit about, because it decides what you're exposing.
An MCP server you add here is called from Clusy's cloud: the agent opens an outbound HTTPS connection to your URL and speaks MCP over it. It does not run inside your notebook sandbox, and it does not run on your machine. Two consequences follow.
- The server has to be reachable from the public internet. One running on your laptop, on
localhost, or inside a private network Clusy can't route to will not work.localhost, private IP ranges, and cloud metadata addresses are rejected outright. - The credentials in those headers are used by Clusy, on your behalf, from Clusy's network, every time the agent calls one of that server's tools.
Approving tools
Connecting a server doesn't hand the agent a blank check. Each server exposes a set of tools, and you approve them one at a time. Until a tool is approved, a call to it comes back as an error asking you to approve it, and the agent carries on without it.
Tools arrive namespaced as mcp__<server>__<tool>, so a search from your server can never be confused with one of Clusy's own. If a server exposes a lot of tools, only a handful are loaded into the agent's working set up front and the rest are held back, still reachable when the agent goes looking for something it doesn't have. A server with dozens of tools is worth trimming to the ones you want used.
What it costs
MCP tool calls are not metered by Clusy. Your server does the work. If the service behind it bills you, it bills you directly.
What isn't free is the model reading the results: everything a tool returns lands in the agent's context and is paid for as ordinary model usage. A chatty tool that dumps a lot of text into every turn is not cheap. See Usage.
Review before you approve
An MCP tool can reach outside Clusy, into your systems, with your credentials. Approve the ones you understand and trust, the way you'd think about granting an app a permission. You can revoke approval or disable the server any time.