How to add a custom MCP server in CrewAI AMP

This walkthrough follows CrewAI's enterprise guide for a custom MCP server in AMP. The clicks are for that AMP form. The page does not document the same steps in the open-source CrewAI library.

CrewAI AMP can connect to any MCP server that implements the Model Context Protocol. That includes a public server with no authentication, a server protected by an API key or bearer token, and a server that uses OAuth 2.0 for delegated access.

What you need first

You need an active CrewAI AMP account.

You also need the MCP server URL. The server must be accessible from the internet and must support Streamable HTTP transport. This page does not describe another transport.

For a non-public server, have the auth values ready. A token connection needs a header name and the key or bearer value. OAuth 2.0 needs an authorization endpoint, a token endpoint, and a client ID. Client secret, scopes, token auth method, and PKCE are optional on the form.

Open the form

In the left sidebar, open Tools & Integrations, then select the Connections tab. Click Add Custom MCP Server. A dialog opens with the configuration form.

Name, description, and server URL

• Name is required. Use a descriptive name. The guide's example is My Internal Tools Server.
• Description is optional. It is a summary of what the server provides.
• Server URL is required. Enter the full URL of the MCP endpoint. The guide's example is https://my-server.example.com/mcp. That example shows the shape of a full URL. It is not a path the guide requires.

Pick an authentication method

Select one of the three methods based on how the server is secured.

No authentication

Choose this when the server is publicly accessible and does not require credentials. The guide says this is common for open-source servers or internal servers running behind a VPN. The prerequisites still say the server must be reachable from the internet. The page states both points and does not reconcile them.

Authentication token

Use this when the server is protected by an API key or bearer token.

• Header Name is required. It is the HTTP header that carries the token. Examples in the guide are X-API-Key and Authorization.
• Value is required. It is your API key or bearer token.
• Add to is optional. Attach the credential as a Header (the default) or as a Query parameter.

If the server expects a bearer token in the Authorization header, set Header Name to Authorization and Value to Bearer <your-token>. Replace the placeholder with your token.

These fields carry the credential. They are separate from the optional custom headers below, which are extra headers sent on every request.

OAuth 2.0

Use this when the server requires OAuth 2.0. CrewAI handles the full OAuth flow, including token refresh.

Redirect URI is pre-filled and read-only. Copy it from the form and register it as an authorized redirect URI in the OAuth provider. The documentation does not print a fixed redirect value, so use the string in your dialog.

• Authorization Endpoint is required. Users are sent there to authorize access. Example: https://auth.example.com/oauth/authorize.
• Token Endpoint is required. It exchanges the authorization code for an access token. Example: https://auth.example.com/oauth/token.
• Client ID is required. It is the client ID issued by your provider.
• Client Secret is optional, and it is not required for public clients using PKCE.
• Scopes is optional. Use a space-separated list. The guide's example is read write.
• Token Auth Method is optional. Choose Standard (POST body), the default, or Basic Auth (header). Most providers use Standard. Some older providers require Basic Auth.
• PKCE Supported is optional. Enable it if the provider supports Proof Key for Code Exchange. The guide recommends PKCE for every new integration.

If the provider supports OpenID Connect Discovery, click Discover OAuth Config. It auto-populates the authorization and token endpoints from the provider's /.well-known/openid-configuration URL. The guide does not say this fills the client ID, client secret, or scopes.

Then follow the guide's order:

1. Register the form's redirect URI with the provider.
2. Enter the authorization endpoint, token endpoint, and client ID. Optionally add the client secret and scopes.
3. Select the token auth method.
4. Enable PKCE if the provider supports it.
5. Click Create MCP Server. You are redirected to the provider to authorize access. After that, CrewAI stores the tokens and refreshes them as needed.

Add custom headers

This step is optional. If every request needs extra headers, such as a tenant identifier or a routing header, click + Add Header and enter the name and value. You can add more than one.

Save and use the tools

Click Create MCP Server to save the connection. For OAuth 2.0, that same button starts the provider redirect, and tokens are stored after you authorize.

The server then appears in the Connections list, and its tools are available in your crews. On Tools & Integrations, those tools sit alongside built-in connections. You can assign them to agents the same way you assign any other CrewAI tool, manage visibility for team members, and edit or remove the connection from the Connections list. This page does not list the later clicks for those three actions.

If the server becomes unreachable, or if credentials expire, tool calls that use it fail. Keep the URL stable and the credentials current. The guide sends configuration and troubleshooting questions to support@crewai.com.

What to do next

Open AMP, go to Tools & Integrations, select Connections, and click Add Custom MCP Server. Enter the name and full server URL, choose the auth method the server actually uses, add any extra headers, and save with Create MCP Server. If the form shows a redirect URI or label that is not printed here, copy it from the dialog or the enterprise guide. Do not invent it.

Sources

• Custom MCP Servers