Skip to content
Open Net Worth Docs

External MCP servers

The Model Context Protocol (MCP) connects a third-party server to Lucius and gives him whatever tools that server exposes — a database, a niche API, a browser-automation tool, another product’s own MCP integration. This is the most powerful connector in the app, and the one that deserves the most caution: a server you connect is code you don’t control, running with access to Lucius’s conversation.

Adding one

From Connectors → Add → MCP server, pick one from the built-in directory or add a custom server:

  • Transport: http (a remote/hosted server you POST JSON-RPC to) or stdio (a local command the app spawns and talks to over stdin/stdout).
  • Authentication: none, a bearer token, a custom header, or OAuth (dynamic client registration + PKCE — a “Sign in” popup, no manual client-secret setup where the server supports it).

Test connect is a gate, not a suggestion — the app reaches the server (handshake + tool listing) before letting you save it. An unreached server is never saved. One consequence: editing a saved server’s connection can’t re-run that test with the secret you saved earlier, since a saved secret is never sent back to your browser — re-enter it (or leave it blank to keep the existing one, where supported) to re-test after an edit.

What a stdio server actually is

Choosing stdio means the app runs a command on this machine — the same as running it in a terminal — and keeps that process alive over stdin/stdout. Whatever that command can do on your machine, it can do, for as long as the connector is enabled. Only add a stdio server whose command you trust the way you’d trust any other software you run locally.

A stdio server’s connection is not spawned fresh per call — it starts once (on enable, or at boot if already enabled) and stays alive, reused by every conversation, until it fails and reconnects, its config changes, or the app shuts down. This fixes real correctness problems (a kept-open browser tab, an authenticated remote session that needs to survive between messages), but also means an enabled stdio server is a genuinely long-running local process, not a one-shot subprocess per call.

Every call still goes through the same permission ladder

An MCP tool is gated exactly like any built-in tool — needs_approval, always_allow, or blocked — defaulting to needs_approval like everything else unconfigured. No separate “trusted server” switch silences confirmation for a whole server; each tool’s level is set individually. Setting one to always_allow fires unattended too, including inside a scheduled Automation, with nobody watching — the same consequence it has anywhere else in the app. Read How permissions work in full before doing that for anything an unfamiliar third-party server offers.

What Lucius is never shown about a server

Two protections exist specifically because a third-party server’s own output reaches the model — and that output is not something you wrote:

  • The model never sees the server’s real address. A remote server reduces to just its host; a local command reduces to just its program name — never the full URL or command line, because on plenty of real MCP servers the connection string itself is the credential (a database URL with a password, an API key on a query string). You, the operator, still see the real thing in Connectors — the restriction is specifically about what reaches the model’s context.
  • Everything the server says about itself is untrusted text, not instructions. A tool’s description, error messages, anything it returns — sanitized and length-capped before Lucius sees it, so a malicious or compromised server can’t smuggle a fake instruction into its output and have it read as if you’d typed it.

Why needs_approval is the right starting point

A server you add is an arbitrary third party whose code you didn’t write and whose future updates you don’t control. Its results can carry a prompt-injection attempt the instant they reach the model, same as any other external content. needs_approval means you see what a tool is actually about to do before it happens — the whole value of the confirm step for a connector you’re still building trust in. Reserve always_allow for a server and tool you’ve used enough to trust like software you installed yourself.

A note on local addresses

The app does not block an MCP server pointed at a local address (http://127.0.0.1:... and similar) — a local MCP server on your own machine is a normal, documented way to use MCP, and adding, editing, or testing a server’s connection is something only you (a logged-in operator) can do; there is no tool that lets Lucius add or repoint a server on his own. If that ever changes, this note would need to change with it.