MCP

How Qore uses the Model Context Protocol: agents connecting to outside MCP servers, and coding agents connecting to Qore's own MCP servers.

Model Context Protocol (MCP) is an open protocol for connecting language models to external tools and data. An MCP server exposes a set of tools; an MCP client connects to the server, lists its tools and calls them.

Qore is on both sides of that protocol:

Direction	MCP client	MCP server	Where it's set up
Outbound	A Qore agent	An MCP server run by a vendor, by your company, or by you	Agent Builder: Create MCP Connection
Inbound	Your coding agent, such as Claude Code or Cursor	Qore's own MCP servers	Build from your IDE in the Agent Builder and the App Builder

In neither direction do you build an MCP server inside Qore. Outbound, the server already exists somewhere else and the agent connects to it. Inbound, Qore runs the servers and your coding agent connects to them.

MCP terms in Qore

Term	What it is in Qore
MCP server	A program, reached at a URL, that exposes tools over MCP. In Qore it's always outside the agent: a vendor's, your company's, or one of Qore's own.
MCP tool	One action an MCP server exposes. Each tool becomes something the agent can call.
MCP connection	An agent's saved link to one MCP server: its name, URL, credentials, headers, and which of the server's tools the agent may use. It belongs to one agent.
Create MCP Connection	The form that creates an MCP connection. Every route to an outside server opens it.
MCP Tools	The page under Agent Config › Integration Tools & Connectors that lists the catalog of servers.
MCP Marketplace	The tab in Add Skill that lists the same catalog. Each entry holds a server's name, URL, category, description and the fields it needs from you.
MCP Server (skill)	The Skill Library entry that opens Create MCP Connection blank, for any server by URL.
Web Crawler (skill)	A Skill Library entry that opens Create MCP Connection prefilled for Firecrawl.
MCP configuration	In Export Agent, a connection's credentials and settings: OAuth client ID and secret, headers and tokens. Off by default. See What an export carries.
MCP config file	A JSON file with an mcpServers object, the format MCP clients use. Import Config File fills the form from the first server in it.
Connector	The Control Center word for anything an agent can reach. Connectors › MCP Servers lists every MCP connection in the account.
Redirect URL	The callback address Qore gives you to register in an MCP server's OAuth app, so the server can return to Qore after someone signs in.
M2M	Machine-to-machine: the OAuth client credentials grant. The agent signs in to the server as itself, with no person involved.
$auth.token	The verified identity token of the person calling the agent, available only inside MCP connection settings.
Supervision mode	Per tool: Always Ask Permissions or Allow Unsupervised.
Build from your IDE	The dialogs in the Agent Builder (Connect to coding agents (MCP)) and the App Builder that give your coding agent Qore's MCP servers.
x-platform-key	The header that carries the API key for Qore's MCP servers. These keys are separate from an agent's API keys and widget keys.

Outbound: an agent connecting to an MCP server

An MCP connection is a skill. Once it's created, the server's enabled tools are available to the agent, and the agent chooses among them at run time. See Skills & Tools.

One form, three starting points

Every outbound connection is made in Create MCP Connection. The three routes differ only in what's filled in for you.

Start from	What's filled in
A server in MCP Marketplace or MCP Tools	Connection Name and Remote MCP Server URL, plus a required field for each value the server needs, such as Api Key
MCP Server in the Skill Library	Nothing. Enter any server's name and URL
Web Crawler in the Skill Library	Name Web Crawler and Firecrawl's URL, with {{api_key}} for you to replace

Every route shows the same warning first: This connector hasn't been officially verified by UPTIQ. Make sure you trust it before using it, as you'll be responsible for any actions it performs. It appears for catalog servers too.

How catalog fields are used

A catalog server's URL or headers can hold placeholders, such as {{api_key}}. Qore replaces each placeholder with what you enter in the matching field, then saves the result.

Catalog server	Field you fill in	Where Qore puts it
Tavily, Alpha Vantage, Finfeed SEC, Finfeed Stock, CoinAPI, Firecrawl	Api Key	The server URL
Core Banking Sandbox API	Token	An Authorization: Bearer header
AWS Knowledge Base Retrieval	None	—

A key placed in the URL is saved in the URL. Connectors shows each connection's URL in full, so anyone who can open it can read the key. Enter a $secret. reference, such as $secret.TAVILY_API_KEY, instead of the key itself: the saved URL then holds the reference. See Secrets & Variables.

Core Banking Sandbox API returns simulated data. Use it to build and test an agent, not to reach a real core banking system.

Advanced Settings: how Qore signs in to the server

Advanced Settings doesn't create anything on the Qore side. It holds the credentials that Qore, as the client, presents to the MCP server. Use it for any server, from the catalog or your own.

Setting	Use it when	What happens
Register this Redirect URL	The server signs people in through OAuth	Copy the Redirect URL and add it as an allowed redirect URI in the OAuth app on your MCP server. OAuth Client ID and OAuth Client Secret are optional: if the server's authorization service supports dynamic client registration, Qore registers itself; if it doesn't, enter the client ID the OAuth app gave you, or the connection fails. The banner shows only when the agent's executor version supports it, and M2M is off.
Authenticate M2M (OAuth client credentials)	The server issues a client ID and secret instead of a sign-in page	Token URL, OAuth Client ID and OAuth Client Secret become required; Scope is optional. The agent requests its own token. There's no sign-in step and no Redirect URL. See Connect with client credentials.
Headers	The server takes a key or token in a header	Key and value pairs sent with every request to the server.

References you can use in the form

• $secret.<name> and $agent.<name> resolve to the agent's stored secrets and variables. Qore resolves them across the whole connection, including the URL and headers.
• $auth.token is offered in the catalog fields, OAuth Client ID, OAuth Client Secret and Headers when the agent has Authentication turned on. It resolves to the verified token of the person calling the agent, so the server can apply that person's permissions. It works only in MCP connection settings: skills and instructions can't read it. Without a token in the request, it resolves empty.

The connection flow

1

Enter the connection

Fill in the form, or Import Config File, then select Next. Qore connects to the server to check it.

2

Authorize, if the server asks

If the server needs an OAuth sign-in and Qore has no token for it, Waiting for Authorization appears. Select Connect to Authorize, sign in to your account in the pop-up and grant the permissions. The dialog continues by itself once you're authorized. Qore skips this check for M2M connections and for URLs ending in /sse.

3

Choose tools and settings

Tools and Settings lists the server's tools, all enabled, with a count such as 5 of 5 tools enabled.

• Enable All Tools turns every tool on or off.
• Each tool has its own switch.
• Each tool has a supervision mode: Always Ask Permissions, the default, or Allow Unsupervised. The menu beside Enable All Tools sets it for every tool at once.
• Select the pencil beside a tool's description to rewrite it.
• A warning icon marks a tool whose input schema is invalid, which might not work with every model.

4

Create the connection

Select Create Connection.

Managing a connection

Open an existing connection to see MCP Server Connection: its name and URL, its tools, and these actions.

Action	What it does
Connect / Disconnect	Turns the connection on or off. Disconnecting asks first: Disconnecting will stop all ongoing sessions using this MCP server.
Remove	Permanently removes the MCP server from the agent, after a confirmation.
Initialize	Shown instead of Connect for a connection that has no credentials yet, such as one imported without its MCP configuration. Reopens Create MCP Connection with its name and URL, so you can finish it.
Manage tools	Change which tools are enabled, their supervision modes and descriptions. You can refresh the tool list from the server.

Re-enter the client secret when you edit an M2M connection. It isn't shown again after saving.

What an export carries

Export Agent always includes the agent's MCP connections. Include MCP configuration, off by default, decides whether their credentials go too.

Include MCP configuration	Each connection in the package	After import
Off (default)	Without its OAuth client ID and secret, headers or tokens, and marked not initialized	Shows Initialize
On	As it is, with its credentials and settings	Ready as it was

Ticking it shows a warning that exporting MCP configuration may expose sensitive credentials, internal tools or privileged access.

Where a connection shows up

Place	What it shows
The canvas	A node in the Skills band, with the server's name
Skills & Capabilities	The server's tools
Connectors › MCP Servers (Control Center)	One row per connection: name and full URL, Standing, Project, and Used by
DB Query Logs (Control Center)	Database operations in the MCP module

Scope

• A connection belongs to one agent. Connectors lists the same server once for each agent that connects to it, with that agent's project.
• The account sets the outer limit. An agent can't use a connector the account hasn't made available, whatever its own configuration requests.

MCP compared to Apps & Services

Both add outside capability to an agent, and the catalogs overlap. Apps & Services lists SaaS connectors such as Stripe and Resend, connected through the Integrations Hub. MCP connections reach any MCP server by URL. For an HTTP endpoint that isn't an MCP server, use the API Call skill.

Inbound: a coding agent connecting to Qore

Qore runs MCP servers of its own, so an MCP-capable coding agent can build on Qore from your editor. Your coding agent is the client; Qore is the server.

The three servers in Connect to coding agents (MCP)

In the Agent Builder, Build from your IDE opens Connect to coding agents (MCP), with an example claude mcp add command for each server.

Server	Endpoint	What a coding agent can do with it
Agent Builder MCP	<BASE_URL>/agent-builder/mcp	Build and manage agents: create, update and delete agents; skills, knowledge, guardrails, execution plans, memory, secrets and access keys; MCP connections and integrations; versions, export and import; plus audit logs, models and usage.
Knowledge MCP	<BASE_URL>/agent-builder/knowledge/mcp	Manage knowledge: datasets and data sources, including uploads and Google Drive, OneDrive, SharePoint and website imports; ingestion, versions and sync; querying; governed graphs; attaching knowledge to agents. It's a separate server so a knowledge client isn't offered the rest of Agent Builder.
Agent Executor MCP	<BASE_URL>/agent-executor/<version>/mcp	Run agents: trigger an agent, follow or abort a run, read conversations and artifacts, answer an agent's questions, and handle documents. The Executor version menu, such as 1.4, sets <version> in the command.

Add the Agent Builder MCP server (Claude Code)

claude mcp add --transport http agent-builder <BASE_URL>/agent-builder/mcp \
  --header "x-platform-key: <YOUR_API_KEY>"

The servers use streamable HTTP and are stateless: every request stands alone.

The App Builder server

In the App Builder, Build from your IDE gives one server, at <BASE_URL>/app-builder/api/v1/mcp. Through it, a coding agent creates an app, follows its build, approves its plan, and makes the choices along the way, such as the design system, the database, and where each service is published. See Build from your IDE.

Keys for Qore's servers

• Every request carries the key in the x-platform-key header.
• Create keys in the dialog, under API keys › + Add Key, and Revoke them at any time.
• A key made in Connect to coding agents (MCP) is valid only for the current workspace and account. It carries the agent capabilities you hold yourself, limited to building, viewing, importing, exporting, publishing, triggering and sharing agents, managing versions, attaching governed graphs, querying knowledge, stopping agents, and viewing credit usage and traces. A coding agent using the key can't do more than you can.
• The App Builder dialog has its own list of keys.

Treat a key as a credential: it lets an outside tool act in Qore as far as the key allows.

Under the hood

Two more uses of MCP need no setup and don't appear as MCP connections:

• Flows and Integrations Hub skills reach the agent executor through Qore's own internal MCP servers.
• MCP tools can return an interactive view. A tool result of type text/html;profile=mcp-app is rendered in a sandboxed view in the chat.

Where this is configured

• MCP Tools: the catalog and client credentials
• Adding a skill to the agent: the MCP Marketplace tab
• Skill Library: the MCP Server and Web Crawler skills
• Authentication: $auth.token
• Export Agent: Include MCP configuration
• Connectors: every MCP connection in the account
• Get Started and Importing apps: Build from your IDE

---

Maintained by Abhishek Paul AI-assisted, human-approved