Tools

Build › Tools is the tenant’s registry of MCP servers. An MCP server is how an agent reaches something outside the platform: a repository, a document store, an internal API. Registering a server grants nothing: an agent may call only the tools you grant it on its own page.

An MCP server is code you run in your own estate. It receives an agent’s tool arguments and returns content that enters a model’s context, so treat registering one as you would any other integration with access to your data.

Who can open it

Role	What they can do
Admin	Register servers, test them, take them in and out of service, remove them, and check what a server offers.
Builder	The same as an Admin.
Auditor	Read the list and each server’s page. Cannot check what a server offers or change anything.
Reviewer, End user	Cannot open it.
Platform admin	Everything an Admin can, in any tenant.

What you see

The Tools list

1. The header: Tools, and a tenant picker when you can see more than one tenant.

2. MCP servers, a table with a search box:

   Column	What it shows
   Server	The name, linking to its page, tagged Platform reviewed or Tenant registered.
   Transport	Streamable HTTP.
   Credential	Stored, or None.
   Used by	How many agents hold grants on it.
   In service	A switch: In service or Out of service. Only an Admin or Builder can change it.
   Registered	When it was registered.
   Actions	Admin and Builder only: Remove server.

3. Register server, in the toolbar, for an Admin or Builder.

With no servers, the table reads No tool servers yet, with Register server for the roles that may use it.

Platform reviewed marks a server the platform has reviewed. Tenant registered marks one your tenant registered.

A server’s page

Open a server from the list. The header shows its name and In service or Out of service. A server out of service carries the notice Taken out of service. Below, in order:

1. How it is reached: Transport, Endpoint, Credential (Stored, sent as the header name, or None), Origin (Platform reviewed or Tenant registered) and Registered. A stored credential is never shown again, by any route.
2. Agents using it: each agent holding grants on this server, with the tools it holds, each Allowed or Needs approval. With none: No agent has been granted a tool on this server.
3. What it offers: Check what it offers now asks the server and lists its tools, each with Agents granted it or Not granted. A server out of service is not asked.

What you can do

Register a server

1. On Build › Tools, choose Register server.

2. Server:

   1. Enter a Name.
   2. Leave Transport at Streamable HTTP.
   3. Enter the Endpoint: the full URL the server answers on, such as https://tools.example.com/mcp.
   4. Choose Next.

3. Authentication: under The server expects, choose one:

   • Nothing;
   • A bearer token (Authorization: Bearer), then enter the Token;
   • A secret in a named header, such as X-API-Key, then enter the Header name and the Secret.

   Choose Next. The secret is sealed when the server is registered and never shown again.

4. Test: Olympusx AI connects with what you entered and lists the tools the server offers. Nothing is saved.

   • Connected. Tools it offers: a count, then the list. Each tool shows whether it asks for approval by default when granted: a tool the server does not declare read-only is Asks for approval when granted, and one it declares destructive is tagged may destroy.
   • The server did not answer: you can still register it, and Test again later.
   • The platform will not connect to this server: the address is refused (see Where a server may run). Registering would be refused too, so Next is off; go back and change the endpoint.

5. Review: check Name, Transport, Endpoint, Authentication and the test result, then choose Register server.

Olympusx AI confirms with Server registered. Grant its tools to an agent next: see Create and edit an agent.

Take a server out of service

1. On Build › Tools, turn the server’s In service switch off.
2. Take server out of service names the agents granted its tools. Confirm with Take out of service.

Every agent granted tools on a server out of service refuses its run and says why, rather than answer without the tools. Turn the switch back on to put the server back in service. The switch is an operator decision.

Remove a server

1. On Build › Tools, open the row’s actions and choose Remove server.
2. Confirm with Remove server.

Olympusx AI refuses to remove a server while any agent holds grants on it; the dialog names those agents. Remove the grants on each agent’s Edit agent page, or take the server out of service instead.

Change a server’s endpoint or credential

A server’s name, endpoint and credential cannot be changed. Register the server again under a new name, move the agents’ grants to it, then remove the old one.

Where a server may run

Olympusx AI connects to the endpoint you register to discover its tools, to call them, and to close each session. The address decides whether it may:

Address	Reached?
A public address	Yes, over https://.
A private network address, such as a Service in the tenant’s own namespace	Only when the platform administrator allow-lists it.
Plain http://	Only to a host the platform administrator allow-lists.
Loopback, link-local, cloud metadata, unspecified and multicast addresses	Never. No allow-list opens these.

The rule is checked when you register and again on every connection, so a name that later resolves to a refused address is refused at the next call, and so is a redirect to one. To run a tool server inside the cluster, ask the platform administrator to allow-list its host name or a network set aside for tool servers; see Network and hardening.

Note

Storing a credential needs the platform’s secrets key, set at installation. Without it, registering a server with a credential is refused with the reason, and a server that already has one cannot be reached.

Limits

Field or rule	Limit
Name	1 to 80 characters; unique in the tenant.
Transport	Streamable HTTP only.
Endpoint	A full URL; https:// unless the host is allow-listed.
Header name	Letters, digits and hyphens, at most 64 characters.
Credential	Write-only: sealed on registration, never returned.
Name, endpoint, credential	Cannot be changed after registration.
Remove	Refused while any agent holds grants on the server.
One tool call	60 seconds by default, set by the platform administrator.
One tool result	32 KB by default, set by the platform administrator; a longer result is cut and the model is told.

Related

• Create and edit an agent
• Skills
• Human approval
• Agents, tools and skills
• Network and hardening