> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traversal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Servers

> Connect any Model Context Protocol server so Traversal can call its tools during investigations.

Connecting an [MCP server](https://modelcontextprotocol.io/) lets Traversal call that server's tools during investigations — pulling in context and capabilities from systems that don't have a dedicated Traversal integration.

## How it works

* Each MCP server is its own integration instance — connect as many as you need, each with its own URL and authentication.
* Traversal connects to remote servers over HTTP-based transports — both **Streamable HTTP** and **SSE** are supported.
* Traversal discovers the tools the server exposes, and you choose which ones to enable from the integration's tool list in the Traversal UI.

<Info>
  Traversal is [read-only by design](/architecture/intro). If an MCP server exposes tools that write or mutate state, add them to the server's **blocked tools** list so Traversal never calls them.
</Info>

## Authentication

Traversal supports three authentication methods for MCP servers. Choose the one your server uses when you configure the integration.

<Tabs>
  <Tab title="Bearer token">
    A static token that Traversal sends as the `Authorization: Bearer <token>` header on every request. Use this when your server authenticates with a long-lived API key or personal access token.

    <Steps>
      <Step title="Get a token from your MCP server">
        Generate an API key or access token in the system that hosts the MCP server. Copy it — you'll paste it into Traversal.
      </Step>

      <Step title="Configure in Traversal">
        Go to **Company Knowledge > Integrations**, add an **MCP Server**, and enter:

        * **Server URL** — the server's streamable-http endpoint (e.g. `https://mcp.example.com/mcp`)
        * **Auth method** — **Bearer token**
        * **Token** — the token you copied
      </Step>
    </Steps>
  </Tab>

  <Tab title="Client credentials">
    A service-account **client ID** and **client secret** that Traversal exchanges for a short-lived bearer token at a token endpoint before each session. Use this for the OAuth 2.0 `client_credentials` grant and similar service-to-service token flows.

    <Steps>
      <Step title="Create service-account credentials">
        In your identity provider, create a service account (or app registration) and note its client ID and client secret, plus the token endpoint URL that issues tokens for it.
      </Step>

      <Step title="Configure in Traversal">
        Go to **Company Knowledge > Integrations**, add an **MCP Server**, and enter:

        * **Server URL** — the server's streamable-http endpoint
        * **Auth method** — **Client credentials**
        * **Token URL** — the endpoint that issues tokens (e.g. `https://auth.example.com/token`)
        * **Client ID** and **Client secret** — sent as HTTP basic auth to the token endpoint

        If your provider needs a custom request body or returns the token under a non-standard JSON key, set the optional **request body** and **token response key** fields. The token key defaults to `access_token`.
      </Step>
    </Steps>

    <Info>
      Traversal fetches a fresh token as needed, so you never store a long-lived bearer token — only the service-account credentials.
    </Info>
  </Tab>

  <Tab title="OAuth">
    Standard OAuth 2.0 authorization-code flow with PKCE (RFC 7636) and Dynamic Client Registration (RFC 7591). You authorize Traversal once, in a popup, at setup time. Use this when your server delegates authorization to an OAuth provider.

    <Steps>
      <Step title="Add the MCP server in Traversal">
        Go to **Company Knowledge > Integrations**, add an **MCP Server**, enter the **Server URL**, and choose **OAuth** as the auth method.
      </Step>

      <Step title="Authorize in the popup">
        Traversal discovers the server's OAuth metadata (RFC 9728 and RFC 8414), registers itself as a client, and opens the provider's authorization page in a popup. Sign in and approve the requested scopes.
      </Step>

      <Step title="Traversal stores and refreshes tokens">
        Access and refresh tokens are stored encrypted. Traversal refreshes the access token automatically when the server issues a refresh token, so you don't need to re-authorize on every session.
      </Step>
    </Steps>

    <Info>
      The OAuth authorization and token endpoints must use HTTPS.
    </Info>
  </Tab>
</Tabs>

## Enabling tools

After a server connects, Traversal lists the tools it exposes. In the Traversal UI you choose which tools to enable and give each one an **agent-facing description** — the text the agent uses to decide when to call the tool. A tool with no configured description won't be surfaced to the agent, so write a clear description for every tool you enable.

Two limits apply, both enforced when you save:

| Limit                   | Value                                                                |
| ----------------------- | -------------------------------------------------------------------- |
| Enabled tools           | Up to **20** enabled tools across all connected MCP servers combined |
| Tool description length | **500** characters or fewer per tool                                 |

Enabled tools and their descriptions are configured per server in the Traversal UI.

## Servers on a private network

If your MCP server — or its OAuth token endpoint — isn't reachable from the public internet, Traversal routes requests through your [Traversal Connector](/architecture/connector), the same relay used by other integrations. No changes to the server are required beyond making it reachable from the connector's network.

## Settings

| Setting               | Description                                                                               |
| --------------------- | ----------------------------------------------------------------------------------------- |
| **Server URL**        | The MCP server's streamable-http endpoint.                                                |
| **Auth method**       | `Bearer token`, `Client credentials`, or `OAuth`.                                         |
| **Blocked tools**     | Tools Traversal will never call, even if the server exposes them.                         |
| **Tool call timeout** | How long Traversal waits for a single tool call before giving up. Defaults to 30 seconds. |

## More information

* [Model Context Protocol](https://modelcontextprotocol.io/)
* [Security, data & permissions](/integrations/mcp-servers-security) — data access, controls, and authentication for security and compliance reviews
* [Traversal MCP server](/using-traversal/mcp) — for driving Traversal from your AI clients