MCP servers

An MCP server is a program that offers tools such as create_issue or search over the Model Context Protocol, and a job with the server attached can call them. You register a server once under MCP servers and attach it to the jobs that need it. Umpteenth runs an MCP server of its own as well, which lets Claude Code and other agents create and run jobs, as Connect an agent shows.

HTTP or stdio

An HTTP server runs somewhere else and answers at a URL. Umpteenth connects to it from the host, so header credentials and OAuth tokens never enter the sandbox, and the server works for jobs with No network. Servers on your LAN work as well, unless you set network.allow_private_targets to false (Configuration).

A stdio server is a command such as npx -y <package> or uvx <package>. Umpteenth starts it inside each run’s sandbox as a separate user, mcp, so the agent can’t read its environment, and stops it when the run ends.

Pick HTTP if a service offers both, since its credentials then stay on the host.

Add an HTTP server

GitHub hosts an MCP server that accepts a personal access token as a bearer token.

1. Create a secret named GITHUB_TOKEN under Settings → Secrets that holds a GitHub personal access token.

2. Open MCP servers and click Add MCP server.

3. Enter github as the Name, pick HTTP under Transport and set the URL to https://api.githubcopilot.com/mcp/.

4. Under Headers, add Authorization with the value Bearer {{secret:GITHUB_TOKEN}}.

5. Click Add MCP server. Umpteenth tests the new server and lists its tools.

The server’s Auth column now shows Bearer token.

Name each server after its service, github rather than gh-final-v2. The compile step matches the services a new job needs to the names of your enabled servers, ignoring case, so add servers before you create the jobs that use them.

Add a stdio server

Brave publishes its search MCP server as an npm package.

1. Create a secret named BRAVE_API_KEY with your Brave Search API key.

2. Click Add MCP server, enter brave as the Name and keep stdio under Transport.

3. Set the Command to npx and add the Arguments -y and @brave/brave-search-mcp-server.

4. Under Environment, add BRAVE_API_KEY with the value {{secret:BRAVE_API_KEY}}.

5. Click Add MCP server.

The default sandbox image ships Node, Python and uv, so npx and uvx servers work without a Dockerfile. A stdio server runs under the job’s network setting, and npx -y downloads its package each time a run starts, so the job needs Internet access. For a No network job, install the package in the job’s Dockerfile and start the installed command instead (Sandboxes).

In a job with Run as root, Umpteenth skips stdio servers that have environment variables, because root could read them, and notes the skip on the run’s timeline. Give such a job an HTTP server, or install its packages with a Dockerfile in place of root.

Tests use the default image with internet access

Test starts a stdio server on the workspace’s Default image with internet access, whatever the settings of the jobs that use it. A server that passes can fail in a No network job, and a command that only a job’s Dockerfile installs fails Test, so check the first run’s timeline.

Test a server

Click Test in the server’s row to connect to it and list its tools. Umpteenth caches the list for the tool picker in job settings, and the Tools column shows how many tools the last successful test found. A stdio test can take up to a minute while npx downloads the package.

OAuth logins

Some hosted MCP servers use an OAuth login in place of a token. If a server you add advertises one, Umpteenth sends your browser to the login right away. For a server you added earlier, click Log in in its row.

The login needs three things:

• app.url in the config file is the URL your browser uses for Umpteenth, because the provider returns to <app.url>/api/mcp-servers/<server id>/oauth/callback.
• You’re signed in to Umpteenth in that browser, since an API token can’t start a login.
• You finish at the provider within 10 minutes.

Umpteenth stores the tokens encrypted, never passes them into a sandbox, and refreshes the access token before it expires, so scheduled runs keep working without you. A login without a refresh token ends when its access token expires.

Your own OAuth client

Without a Client ID, Umpteenth registers itself with the provider as a client when you log in. Some providers don’t allow that, and the login fails with the authorization server doesn't support dynamic client registration, so the server needs an OAuth client ID. For those, register an OAuth app with the provider yourself:

1. Open Edit from the server’s row menu and expand OAuth client.

2. Copy the Callback URL into the provider’s app as an allowed redirect URL.

3. Enter the app’s Client ID. If the app has a client secret, store it under Settings → Secrets and enter a reference such as {{secret:CLIENT_SECRET}} as the Client secret.

4. Click Save, then Log in.

Fill in Scopes there to request other scopes than the ones the server asks for.

Resource parameter

Entra ID refuses the login to some MCP servers with invalid_target: AADSTS9010010, because the resource the server advertises differs from the resource its scopes belong to. The Azure DevOps MCP server at https://mcp.dev.azure.com/<organization> is one of them, and it needs your own OAuth client as well, since Entra ID doesn’t register clients on request.

For such a server, expand OAuth client and turn off Send the resource parameter. Saving the change ends the server’s login, so click Log in afterwards.

Caution

Turn off the resource parameter only for a server you trust. The provider checks it to stop a malicious MCP server from requesting tokens for another API, such as Microsoft Graph, and receiving them once you log in. Umpteenth never leaves it out on its own.

Attach servers to a job

On the New job review screen, the MCP servers card lists the services the compile step found that match one of your servers. Each of them comes pre-ticked under Attach servers, and a service without a matching server isn’t listed.

After you save the job, its Settings tab has an MCP servers card. Add a server from the Attach server menu, remove one with its × button, and click Save at the bottom of the card.

To pause a broken server without detaching it from its jobs, turn off its Enabled switch on the MCP servers page. Umpteenth skips a disabled server in every job, and each job’s MCP servers card marks it Disabled.

Limit the tools

A digest job that reads pull requests has no use for the tool that merges them, so leave that tool off its list. A new attachment allows all of the server’s tools, including the ones it adds later. Once you’ve tested the server, the tools button on the attachment opens a checklist, where you untick All tools and pick the tools the job needs.