Skip to content
Synoec

MCP

Settings → Connected Tools manages MCP servers for the workspace. Add a connection as a Remote Server (URL with a header, environment variable or OAuth Sign-In) or a Local Process. Project and plugin sources need Review & Trust… before their servers load. Each server shows its Tool loading: tools load up front or on demand. A server that has not connected within a few seconds of a chat or company starting never delays it; its tools join when it answers.

Terminal window
synoec mcp list
synoec mcp add docs --url https://mcp.example.com --bearer-env DOCS_TOKEN
synoec mcp add files -- npx -y @modelcontextprotocol/server-filesystem /path/to/dir
synoec mcp login docs
synoec mcp login docs --profile Work
synoec mcp doctor docs
synoec mcp serve

An account sign-in belongs to a Profile (ADR 0288): a chat uses the sign-in of its own Profile, so Work and Personal can be signed in to the same server as different accounts. synoec mcp login and logout act on the Profile --profile names, else the one SYNOEC_PROFILE pins, else the workspace’s default; synoec mcp doctor checks that same Profile. A server added by its address alone that asks for an account gets Synoec’s own registration with its sign-in service on the first synoec mcp login, as the desktop does. A service that lets no app register itself, such as Google’s, signs in through an app registered with it once (ADR 0290): download the “Desktop app” OAuth client JSON from Google Cloud Console and run synoec mcp sign-in-app import google <file>. The desktop and CLI then sign in to Google’s servers (Gmail, Calendar, Drive, BigQuery) through it. Saved keys and tokens typed for a server still belong to the whole workspace.

A local server’s own tool labels decide what asks: a tool marked read-only and closed-world runs without asking; one that changes only the server’s own state asks like an edit under Strict. Anything else, and every remote server’s tools, asks as a network, file and process action. A bearer token travels over plain HTTP only at a literal private IPv4 address, with --allow-private-network-http; DNS names, public addresses, loopback and OAuth need HTTPS. synoec mcp add also takes --startup-timeout and --tool-timeout in milliseconds, a tool call accepting 100 to 600,000 ms and otherwise timing out at 30 seconds.

synoec mcp serve exposes Synoec itself as an MCP server over stdio. See the MCP contract.