ChatChat agents already connect to a catalogue of 36 built-in tools. With this release, they can connect to any remote MCP server you choose to add yourself.

You can now add, edit, refresh and remove a custom MCP connector directly from Integrations, and attach it to an agent the same way you would a built-in one.

Adding a connector

A custom connector can authenticate in one of three ways: no authentication, OAuth with Dynamic Client Registration, or pre-registered static OAuth credentials. Once added, it appears in the regular Integrations experience alongside the built-in catalogue, and any agent can be given access to it, capped at six connectors per agent as usual.

Security and reliability

We treated this the way we'd treat any feature that lets an agent reach outside ChatChat. OAuth client IDs and secrets are encrypted at rest and excluded from normal responses. Every remote MCP URL is validated against SSRF risk before it's used, and sensitive OAuth endpoints are required to run over HTTPS. Redirects are revalidated hop by hop, and a redirect that crosses origins drops the Authorization header rather than carrying it along.

Connector icons only accept safe, absolute HTTP or HTTPS URLs. A javascript:, data:, relative, or malformed URL is rejected outright. Remote tool names are sanitised and made unique before they become callable by the model, and connector IDs are no longer shown to users as opaque run-step labels. ChatChat uses the connector's own display name instead.

Explore Custom MCP Connectors on chatchat.com

Introducing Custom MCP Connectors