MCP integration

Declaring an MCP server is not the same as making a tool available.

MCP is used in both directions: a run acts as an MCP client for approved external servers, and the platform exposes its own first-party MCP server for assistants and external clients. In both directions the same rule holds — configuration, scope, live authorization and evidence stay separate decisions.

Book a demo All integrations

What it does

MCP inside a governed run.

How MCP participates once it is connected — and what the platform does with what it returns.

A central server registry
Servers are configured once with a transport, an endpoint, an authentication type, a credential reference and a timeout. Pipeline YAML cannot define arbitrary servers; it can only reference approved profiles.
Profiles as approved bundles
A profile names specific tools from a configured server. That bundle — not the server's full catalogue — is what a run can reach, and profiles apply to goal steps rather than to script steps.
Live authorization at call time
The caller, action, resource and runtime context are evaluated before a permission-bound tool is exposed or invoked. The tool list a subject sees is already filtered to what they may actually use.
A first-party hosted server
The platform's own MCP server runs as the current authenticated user, re-checking the specific resource identified by each call's arguments. It does not elevate to admin, and write-oriented operations return validated proposals rather than mutating production state.

How it stays governed

The controls that make it safe to leave connected.

An integration is easy to add and hard to bound. These are the parts that decide whether it stays reviewable six months later.

Only system configuration defines servers

The registry is owned by system or global configuration. Team-level configuration can reference approved profiles but cannot introduce new servers — which is what stops the tool surface growing sideways.

Credentials are references

Bearer tokens and comparable material live in the encrypted credential registry with versioning, rotation and consumer access logs. The registry entry carries a reference, not a value.

Examples are disabled by default

Registered example servers and profiles start disabled. Enabling a tool is a deliberate act, which is the opposite of the failure mode where a demo configuration quietly becomes production capability.

Mutations require confirmation

Tools with side effects require explicit confirmation before they run, and destructive or externally visible operations are exposed only through dedicated tools with their own confirmation semantics.

Configuration

Owned by Git, reviewed like code.

Configuration is a reviewable file rather than a form someone filled in once. Credentials appear as references; the values live in the encrypted registry.

setting/system/mcp.yamlYAML

mcp_servers:
  github:
    display_name: GitHub MCP
    enabled: true
    provider: github
    transport: streamable_http
    url: https://api.githubcopilot.com/mcp/x/all/readonly
    auth_type: bearer_token
    credential_ref: credential://system/mcp/github-readonly
    timeout: 30s

mcp_profiles:
  github-pr-review:
    description: Read-only GitHub PR review tools
    enabled: true
    servers:
      - server: github
        tools:
          - "*"

In context

Workflows where MCP shows up.

The same integration, seen from the workflow rather than from the connection.

03Incident

Production incident at 2 a.m.

At 2 a.m. the hard part is finding what changed and deciding whether rollback is safe — fast, without losing the evidence trail.

ServiceNowCI/CDGitHubJira

Open use case

04QA

QA is blocked on unclear requirements

QA loses time reconstructing intent. Testing can start from the wrong assumption and clarification cycles cost a day or more.

JiraConfluenceGitHub

Open use case

08Security

A security vulnerability scan flags an issue

One vulnerability can span many repos and teams. Manual discovery is slow, incomplete and easy to miss under SLA pressure.

GitHubJiraServiceNow

Open use case

Common questions

What teams ask about MCP.

Can a pipeline author add their own MCP server?

No. Pipeline YAML may reference approved profiles only, and the server registry is owned by system or global configuration. This is deliberate: it keeps the reachable tool surface a reviewed decision rather than a per-pipeline one.

What stops an agent calling a tool it should not?

Two things in sequence. The profile bounds which tools exist for that run at all, and live authorization evaluates the caller, action and resource before a permission-bound tool is exposed or invoked. Configuration alone is not treated as permission.

Where do local MCP servers run?

Wherever you host them, as long as the address is reachable from the platform runtime. Note that inside a container, localhost refers to the container itself — a LAN address or the platform's host alias is what you generally want.