Skip to main content

​
Overview

Bring Your Own MCP (BYOM) lets your organization plug an external MCP (Model Context Protocol) server into Minoa. Once connected, the tools, resources, and prompts your server exposes become available to Minoa’s AI agents. Minoa can then pull in your product analytics, internal knowledge, support data, warehouse queries, or anything else you already serve over MCP.
Bring Your Own MCP is currently in beta. Reach out to support@minoa.io to have it enabled for your workspace.
BYOM or the Minoa MCP Server: which do I want?
  • Minoa MCP Server is outbound. You connect an AI client such as Claude, Glean, Dust, or n8n to Minoa so that client can read Minoa data.
  • Bring Your Own MCP (this page) is inbound. You point Minoa at an MCP server you run so Minoa’s agents can use its tools.
They solve opposite problems. Use either on its own, or both together.

​
What you can do with BYOM

Once an external MCP server is connected and enabled, the tools it exposes become available to Minoa’s research agent, the agent that handles account research and writes account overviews. Connected servers show up in the Business Case Copilot’s context panel, and the agent calls those tools alongside Minoa’s built-in research flow when they’re relevant to a deal. When Minoa connects to your server it runs the standard MCP handshake, caches the capabilities it finds, and re-discovers on demand from the server detail view.

​
Requirements

Before connecting a server, make sure:
  • The server supports MCP protocol version 2024-11-05 (Minoa initializes MCP sessions with that version).
  • It is reachable over the public internet at an HTTPS URL.
  • It accepts MCP JSON-RPC requests over HTTP. Minoa POSTs to the server’s base URL, falling back to /mcp, /rpc, and /jsonrpc if the base URL doesn’t accept POST directly.
  • You have admin permissions in your Minoa workspace to add or modify MCP servers.

​
Authentication modes

Minoa supports three authentication modes. The one you choose decides how credentials are scoped:

​
API key details

When API Key is selected, Minoa attaches the key as both Authorization: Bearer <key> and X-API-Key: <key> on every request, so most common server conventions work without extra setup. The key is stored once at the org level and reused for all requests.

​
OAuth 2.0 details

For OAuth servers, Minoa implements the MCP OAuth profile:
  • Discovery: Minoa fetches /.well-known/oauth-authorization-server (RFC 8414) on the MCP server’s origin to locate the authorization, token, and registration endpoints.
  • Dynamic client registration: if the server advertises a registration_endpoint (RFC 7591), Minoa registers itself automatically. If dynamic registration isn’t available, contact Minoa support to register a client manually for your server.
  • Authorization Code with PKCE: Minoa uses PKCE for every OAuth flow, and the PKCE verifier never leaves Minoa.
  • Per-user tokens: each user who wants to use an OAuth-backed server starts their own OAuth flow from the server details view and goes through your server’s consent screen. Their access token, and refresh token if one is provided, is stored against their user account and never shared.
  • Automatic token refresh: Minoa refreshes OAuth tokens before they expire and retries once on a 401 response. When a refresh is no longer possible, the server is marked needsAuth and the user is prompted to re-authenticate.
OAuth callback URL, which you may need to allowlist on your OAuth server:

​
Connecting a server

1

Open the Integrations panel

Go to Settings → Integrations. If BYOM is enabled for your workspace, you’ll see an MCP Servers section. Click Add MCP Server.
2

Enter the basics

Provide a name, the server URL (HTTPS), and an optional description and tags. Tags appear as badges on the server card for quick categorization, for example analytics, support, or warehouse.
3

Choose an auth type

Pick None, API Key, or OAuth. For API Key, paste the key. For OAuth, you’ll be redirected to your server to sign in and authorize Minoa in the next step.
4

Test the connection

Minoa runs the MCP handshake and discovers the server’s tools, resources, and prompts. You’ll see counts for each once discovery finishes.
5

Review and save

The server is saved. For OAuth-backed servers, every member of your workspace needs to connect from their own account before Minoa can make requests on their behalf. Until they do, they’ll see the server marked “Auth needed”.

​
Server configuration options

Each connected server has a few extra fields you can edit from the server detail view:
  • Agent instructions: free-form guidance added to Minoa’s research agent whenever this server is available. Use it to explain how to map Minoa’s deal context to entities in your system, which tools to prefer, naming conventions, and so on.
  • Sample questions: a short list of example prompts that appear in the Business Case Copilot’s research panel as quick-start suggestions, so users know what this server can answer.
  • Auto-generated starting points: the first time Minoa discovers a server’s tool surface, it drafts initial agent instructions and sample questions for you. You can edit both freely.

​
Security and credential handling

  • Credential scope: for None and API Key auth, credentials are stored once at the workspace level and used by all of your users. For OAuth, credentials are per user. Each member authenticates individually, and Minoa only ever uses their own tokens for their own requests.
  • HTTPS only: MCP server URLs must be HTTPS, and Minoa validates outbound requests to prevent access to private networks and cloud metadata endpoints.
  • Server-side credentials: API keys, access tokens, and refresh tokens are never returned to the browser. They are stored server-side and used only to make requests to your MCP server.
  • Audit trail: every change to an MCP server connection is audited with the acting user.

​
Connection states

An MCP server will be in one of the following states in the UI: For personal-scoped (OAuth) servers, each user has their own status, independent of other members of the workspace.

​
Troubleshooting

The MCP server’s OAuth metadata did not expose a dynamic registration endpoint (RFC 7591), or registration was rejected. Register a client with your OAuth provider manually, then provide the client ID and secret through Minoa support.
An access token has expired and the refresh token is no longer accepted. Open the server’s menu and click Re-authenticate to run the OAuth flow again.
  • Confirm the server’s status is connected, not needsAuth, disabled, or error.
  • Click Discover Capabilities on the server card to re-pull the tool list.
  • Make sure each tool exposes a meaningful description. Minoa’s agent reads descriptions to decide when to call a tool.
Minoa tries one automatic token refresh on a 401 before surfacing the error. If it still fails, either your API key is wrong, the OAuth token has been revoked, or the server doesn’t accept Authorization: Bearer <key> or X-API-Key. Reach out to support if you’ve ruled the first two out.

​
Need help

For beta access, auth questions, or help wiring up a specific MCP server, email support@minoa.io.