Skip to main content

Connect to an external MCP server

Connect Retool to an external MCP server and give agents access to its tools.

Model Context Protocol (MCP) is an open standard that lets AI systems discover and call tools exposed by a remote server. Create an MCP resource to connect Retool to an external MCP server and give agents access to the tools it exposes.

This guide covers connecting to an external MCP server. If you want Retool itself to act as an MCP server that other clients can connect to, refer to Use MCP to build apps instead.

What you can do with an external MCP server in Retool​

After you create an external MCP server resource in Retool, you can:

  • Give an agent access to the tools an MCP server exposes.
  • Let an agent dynamically discover and select from the tools available at connection time.
  • Authenticate with public MCP servers or private servers that require credentials.

Before you begin​

To connect an external MCP server to Retool, you need the following:

  • MCP server URL: The absolute URL of a remote MCP server that supports Streamable HTTP or Server-Sent Events (SSE) transport.
  • Server credentials: Authentication details if the MCP server requires them, such as a username and password, bearer token, or OAuth 2.0 client credentials.
  • Retool permissions: Edit all permissions for resources in your organization.
Local MCP servers

Retool only connects to remote-hosted MCP servers over HTTP or HTTPS. Servers built to run locally over stdio must be exposed through an HTTP gateway before you can connect them. Refer to Connect an MCP server to an agent for instructions.

Create an external MCP server resource​

Follow these steps to create an external MCP server resource in your Retool organization.

1. Create a new resource​

In your Retool organization, navigate to Resources in the main navigation and click Create new → Resource. Search for MCP and click the MCP Server tile to begin configuration.

2. Configure general settings​

Specify a name and description for the resource that indicates which MCP server it connects to. The description provides more context to users about how to use the resource.

External MCP server resource configuration form.

Resource name and description​

Choose a name and description that indicate which MCP server the resource connects to.

Example nameExample description
Docs search MCPExternal MCP server that exposes tools for searching product documentation.
Support tools MCPExternal MCP server that exposes tools for looking up support tickets and customer accounts.

3. Configure resource credentials​

Configure the connection settings for your external MCP server resource.

Server URL​

The absolute URL of the MCP server, including the transport path if the server requires one.

Examples
https://mcp.example.com/mcp
https://mcp.example.com/sse

4. Configure authentication​

Choose an authentication method based on how the MCP server is secured.

Authentication methodUse cases
AutomaticRetool detects whether the server requires authentication at all, discovers its requirements if so, and, if the server supports OAuth 2.0 client registration, registers a client automatically.
OAuth 2.0The server requires user-specific authentication with an Authorization Code grant, using PKCE. Each user who accesses the resource authenticates with their own account on the MCP server.
Basic AuthThe server accepts a static username and password.
Bearer TokenThe server accepts a static token, sent as an Authorization: Bearer header.
option A: automatic (recommended)

Retool attempts to detect whether the server requires authentication at all, then discovers its requirements and pre-fills the remaining fields. If the server uses a different authentication method, or doesn't advertise an OAuth 2.0 endpoint, configure authentication manually instead.

  1. Select Automatic from the Authentication dropdown.
  2. Click Auto-configure authentication.
  3. Review the discovered settings before connecting with OAuth.
option B: OAuth 2.0
  1. Select OAuth 2.0 from the Authentication dropdown.
  2. Enter the Authorization URL and Access Token URL published by the MCP server.
  3. Enter the Client ID and, if required, the Client Secret.
  4. Save the resource, then click Connect with OAuth. Retool redirects you to the MCP server to grant permissions.
Client Secret storage

Retool encrypts the Client Secret field automatically. Enter it directly in the resource configuration rather than storing it elsewhere.

option C: basic auth
  1. Select Basic Auth from the Authentication dropdown.
  2. Enter the Username and Password provided by the MCP server.
option D: bearer token
  1. Select Bearer Token from the Authentication dropdown.
  2. Enter the Bearer Token provided by the MCP server.

5. Configure advanced options​

Outbound region​

If your organization uses outbound regions, select the region that should be used for requests to the MCP server. This controls which geographic region your requests originate from.

6. Test the connection​

Click Test connection to verify Retool can reach the MCP server and list its tools. If the test succeeds, you see a success message. If it fails, check the following:

  • Server URL: Confirm the URL includes the correct transport path and is reachable over HTTPS.
  • Authentication: Confirm the selected method matches what the MCP server expects.
  • Network access: For self-hosted instances, confirm the MCP server is reachable from your Retool instance's network.
Use Debug Tools for detailed connection information

After testing the connection, click View in console to open the Debug Tools console. The console displays the request and response details for the tool-listing call, which is helpful for diagnosing authentication or network issues.

7. Save the resource​

Click Create resource to save your external MCP server resource. You can now add it as a tool on an agent.

Interact with MCP server tools​

Once you've created an external MCP server resource, an agent can retrieve and call the tools it exposes.

Add the resource as an agent tool

You cannot write queries directly to an MCP server resource. Retool discovers and invokes its tools automatically. To give an agent access, add the resource as a tool on the agent. Refer to Connect an MCP server to an agent to learn more.

Best practices​

Follow these best practices to maintain the security of your external MCP server resource.

  • Use HTTPS only: Always connect to MCP servers over HTTPS to encrypt data in transit and protect authentication credentials.
  • Prefer OAuth 2.0 for private servers: Where the MCP server supports it, OAuth 2.0 lets each user authenticate with their own account rather than sharing a single static credential.
  • Rotate credentials regularly: Follow the MCP server provider's recommendations for credential rotation and key management.
  • Use resource environments: Organizations on an Enterprise plan can configure multiple resource environments to point at different MCP servers for production, staging, and development.
  • Review tools before granting access: MCP servers can change the tools they expose at any time. Review the tool list an agent retrieves before relying on it in production.