Connect an MCP server

Fainflow lets you connect any remote MCP (Model Context Protocol) server — your own, or a popular one like Atlassian (Jira/Confluence) or GitHub. Once connected, its tools become usable inside flows (the Call MCP Tool action) and bridges. Every user connects their own servers — your credentials are encrypted and scoped to you.

You connect a server with one of five authentication methods. Pick the one the server documents.

Authentication methods

Rule of thumb: a token (Bearer / API key / Basic) is the quickest — you paste a credential you already have. OAuth is the smoothest for supported providers — you sign in, and Fainflow stores and auto-refreshes the tokens for you.

How to connect

1. Dashboard → Connections → Add connection → search MCP Server.
2. Enter the server URL (e.g. https://mcp.atlassian.com/v1/mcp).
3. Choose the Authentication method.
4. Token methods → fill the credential → Create. OAuth → Connect with OAuth and approve in the popup.

The connection turns active when Fainflow can reach the server and list its tools.

Token methods (Bearer / API key / Basic)

Per-user and simplest — you supply a credential you control; it is stored encrypted in the vault. Nothing extra is needed on the Fainflow side.

• Bearer — paste the token; sent as Authorization: Bearer <token>.
• API key header — give the header name (e.g. X-API-Key) and the key.
• Basic — username + password (or username + API token).

What the token can do is decided by the server (the token's own scopes/permissions).

OAuth (sign in)

Click Connect with OAuth → you are redirected to the provider to sign in and authorize Fainflow → you land back on Connections and the connection is active. Fainflow stores the access + refresh tokens and refreshes them automatically.

There are two kinds of OAuth MCP servers, and they differ only in one-time setup:

• Self-registering (DCR) — e.g. Atlassian. Works out of the box: Fainflow registers an OAuth client automatically per connection. No operator setup.
• Pre-registered app required — e.g. GitHub (its OAuth has no dynamic registration). A Fainflow operator registers one OAuth app for that provider, shared by all users (config keys like GITHUB_OAUTH_CLIENT_ID/SECRET). This is a one-time operator step, not per-user — and it is needed only for the OAuth path. The token path never needs it.

Atlassian — both ways

• OAuth → the full Atlassian Rovo toolset (Jira + Confluence — ~31 tools: search/get/create/edit/transition issues, pages, spaces, …).
  • Org allowlist: your Atlassian org admin must allowlist the redirect URL https://<your-fainflow-domain>/dashboard/api/auth/mcp/callback for your site — see Atlassian's Control Atlassian Rovo MCP server settings guide. Until then the consent screen says “organization admin must authorize”.
• Token → use Basic with your Atlassian email + an API token. Standard Jira/Confluence tools work; some Rovo / Teamwork-Graph tools are OAuth/admin-only, so OAuth is recommended for full access.

GitHub — both ways

• OAuth → Connect with OAuth and sign in to GitHub (uses the shared operator app).
• Token → paste a GitHub Personal Access Token (PAT) as Bearer. Scoped to the PAT; no operator app needed.

Troubleshooting

• Consent says “organization admin must authorize” → allowlist the redirect URL on the provider side (Atlassian: the Rovo MCP settings guide).
• Missing tools / 401 on calls → the token's scopes/permissions are too narrow, or the token expired — re-issue it, or reconnect via OAuth (which refreshes automatically).
• Connect seems stuck → resolved; servers that don't implement RFC 9728 metadata are handled. If it persists, retry a fresh connect (don't reuse an old authorize link).