> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ewake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom MCP Server

> Connect any MCP server you run so ewake can call your own tools during investigations.

<Info>
  **What you'll get:** ewake can consult a tool surface you own — an internal API, a bespoke log store, a service catalog — during an investigation, alongside its built-in integrations. If you can expose it over MCP, ewake can query it.
</Info>

<Note>
  This page is about connecting **your** MCP server **to** ewake. For the reverse — querying ewake from Claude Code, Cursor, or another MCP client — see [MCP Server](/interfaces/mcp).
</Note>

***

## Prerequisites

* An MCP server reachable over **HTTPS**, using **streamable HTTP** transport
* A publicly reachable URL for it (through a tunnel such as Cloudflare Tunnel or ngrok if it lives inside your network)
* **Read-only credentials** for whatever the server talks to

***

## Configuration

<Steps>
  <Step title="Expose your MCP server over HTTPS">
    Ewake calls your endpoint outbound; there are no inbound ports to open on ewake's side. Point it at a stable URL, for example `https://mcp.yourcompany.com/logs/mcp`.
  </Step>

  <Step title="Open the Custom MCP integration in ewake">
    In your ewake dashboard, go to **Integrations** → **Custom** → **Custom MCP** → click **Connect a server**.
  </Step>

  <Step title="Describe the server">
    | Field              | Value                                                                                                                                                |
    | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **Server name**    | A label to tell your servers apart (e.g. `logs`, `internal-tools`). Letters, digits, `-` or `_`, starting with a letter or digit, max 64 characters. |
    | **MCP Server URL** | The HTTPS endpoint, streamable HTTP                                                                                                                  |
    | **Description**    | One line on what this server exposes (e.g. "ClickHouse cluster with production logs")                                                                |

    <Warning>
      The **Description** is not decoration. Ewake uses it to decide whether to consult this server during an investigation. A vague description means the server rarely gets called.
    </Warning>
  </Step>

  <Step title="Add request headers">
    Under **Request headers**, add whatever your endpoint requires — an `Authorization` bearer token, or a Cloudflare Access service token (`CF-Access-Client-Id` and `CF-Access-Client-Secret`).

    Values are stored encrypted.
  </Step>

  <Step title="Test the connection and pick the tools">
    Click **Test connection**. Ewake lists every tool the server advertises and asks which ones it may call.

    Use **Select read-only** to tick the tools whose names look read-only (`list…`, `get…`, `search…`, `query…`, and similar), then adjust by hand.

    <Warning>
      Ewake can only call the tools you tick here — nothing else the server exposes, **even if it adds tools later**. New tools are not auto-approved; come back and tick them.
    </Warning>
  </Step>

  <Step title="Save">
    Click **Save**.

    <Check>
      The server is connected. Ewake will consult it during investigations when the description matches what it's looking for.
    </Check>
  </Step>
</Steps>

***

## Connect more than one server

Custom MCP is a **multi-instance** integration: connect as many servers as you need, each with its own name, description, headers, and tool allowlist. They appear as separate entries under **Connected servers**, and you can disconnect one without affecting the others.

Give each a distinct description — that's what ewake matches on when deciding which server to consult.

***

## Security

* **You choose the tools.** The allowlist is enforced on ewake's side; unticked tools are never called.
* **Connect with read-only credentials.** The allowlist is a guardrail, not a substitute — read-only credentials mean writes are refused at the source even if a tool is mis-ticked.
* **Headers are stored encrypted**, the same way integration secrets are.
* **Outbound only.** Ewake calls your endpoint; you open no inbound ports to ewake.

<Card title="How ewake handles permissions and data →" icon="shield-halved" href="/security/permissions" horizontal />

***

Need help exposing a server? Contact [support@ewake.ai](/support).