Guide

Remote MCP

Give AI clients project-scoped tools through stateless Streamable HTTP.

On this page

Prerequisites
Configure a client
Expected result
Errors
Next step

Prerequisites

Enable Remote MCP for one project, choose the allowed tools, and create a dedicated MCP-purpose key. Read scopes and write scopes remain separate; tool policy never expands a key.

Configure a client

Use the remote endpoint and store the key in the client's secret facility.

json

{
  "mcpServers": {
    "moira-connect": {
      "url": "https://mcp.moiraconnect.com/mcp",
      "headers": {
        "Authorization": "Bearer ${MOIRA_MCP_KEY}"
      }
    }
  }
}

Every HTTP request creates a fresh server instance. Project context, account allowlists, provider capability, entitlement, and rate limits are rechecked before Gateway access.

Expected result

get_project_context returns exactly the key-bound project. Read tools return project resources, while send_message requires both an enabled tool and messages:write.

Errors

401 unauthorized means the key is invalid, not MCP-purpose, or Remote MCP is disabled.
A tool error naming a scope requires a newly scoped key; policy cannot add that scope.
Unsupported provider capability errors are real account state, not transport failure.

Next step

Run list_accounts, inspect account health, and enable write tools only after reviewing the client's confirmation model.