Add an MCP server manually

Add a Model Context Protocol (MCP) server by manually entering its connection details and credentials.

Before you begin

  • You have the super admin role or a custom role with the Manage third-party MCP Servers permission and resource type. See Use custom admin roles.
  • If you're securing your MCP server with a custom authorization server, you've already created one. See Create an authorization server.

Procedure

  1. In the Admin Console, go to Applications and Resources > MCP Servers.
  2. Click Add custom MCP.
    The Add MCP server page opens.
  3. Enter a name, description, and resource identifier URL for the MCP server.
  4. Click Save.
  5. Add an authorization server.

    If Okta discovers an authorization server from the resource identifier URL, it appears on the page. Click Configure to review its details and skip the substeps that add a server.

    1. Click Add authorization server.
    2. Select an authorization server type.
    3. If you select External server, enter an Issuer, Authorization endpoint URL, and Token endpoint URL. If the authorization server supports Dynamic Client Registration (DCR), enter the DCR registration URL.
    4. If you select Okta custom authorization server, select the authorization server that you want to use from the list.

      Okta supports cross-app access (XAA) for custom authorization servers, and so no credentials are required. After you save, click Done and close.

  6. Click Save.
  7. If you're using an external authorization server, add credentials for the MCP server.
    1. Enter a Client credentials name.
    2. Select a client registration type.

      You can't switch to another registration type after saving.

    3. If you select Static credentials (client ID and secret), enter your Client ID and Client secret.

      You must configure the client as a confidential client using the authorization code flow, which requires a client ID and client secret.

    4. If you select Dynamic Client Registration, Okta registers a client with the provider and populates the credentials.

      This option is only available if you provided a DCR registration URL.

    5. Select or add scopes. Scopes are automatically populated when available through metadata discovery.
    6. Click Add to add more scopes.
    7. Click Save.
  8. If you added credentials and have Agent Gateway enabled, click Test credentials and discover tools to validate your credentials and view available tools.
  9. To create more client credentials sets for an external authorization server, click Add and repeat the previous steps.
  10. Click Done and close.

    The MCP server appears on the MCP Servers page and can have one of the following statuses:

    • ACTIVE: The default status for newly added MCP servers.
    • INACTIVE: An admin has deactivated the MCP server and you can't use it for managed connections.
    • INVALID: The MCP server is missing authorization server information or contains corrupted metadata.
  11. To add more authorization servers, click Add authorization server and repeat the previous steps.

What to do next

Create a resource connection between the MCP server and an AI agent. See Connect AI agents to resources.