# Create a custom connector

Register an MCP server as a governed connector for your tenant, discover and review its tools, activate it, and configure agent access.

A connector is how an agent reaches an MCP server without launching one itself. A tenant
administrator registers the server once; the platform discovers its tools, you review them, and
agents declare the tools they need by referencing this connector in their manifest.

> **Availability:** Custom connectors are enabled per tenant and need the `manage` capability in your workspace. See [What is available where](/reference/availability).

1. **Create** the connector with its endpoint and authentication mode.
2. **Test** reachability and **discover** its tool inventory.
3. **Review** each tool you intend to expose.
4. **Activate** the connector.
5. **Configure agent access** using a direct connector declaration.

## 1. Create

From the Console, open Connectors and choose Add connector. Where the updated ownership controls
are available, choose **Workspace** or **Platform-wide** explicitly. Workspace ownership belongs
to the selected workspace; platform-wide ownership requires platform administration authority and the **Platform** context.
Ownership describes who manages the connector, not which upstream data a user may access.

From the CLI, inspect the supported scope and tenant flags:

```bash title="Terminal"
tanomis mcp connector create --help
```

A connector has a name, the server endpoint, and an authentication mode: service authentication
with a credential reference the connector owns, or none for an unauthenticated endpoint. Secret
material is never placed in an agent manifest.

## 2. Test and discover

```bash title="Terminal"
tanomis mcp connector test CONNECTOR_ID
tanomis mcp connector discover CONNECTOR_ID
tanomis mcp connector tools CONNECTOR_ID
```

`test` probes reachability and `tools/list`. `discover` records the tool inventory and prints the
diff since the last discovery, so a server that changed a tool's schema shows up before an agent
trips over it. `tools` lists the discovered inventory with the names you will use in allowlists.

## 3. Review

```bash title="Terminal"
tanomis mcp connector review CONNECTOR_ID --tool create_issue --status approved
```

A tool's review status is what makes it available to agents. Review is per tool, so a server
with thirty tools exposes only the ones you approved.

## 4. Activate

```bash title="Terminal"
tanomis mcp connector set-status CONNECTOR_ID active
```

Activation is an explicit step; probing and discovery never change status. The server enforces the
transition rules and the authorization; the CLI only refuses values outside the vocabulary.

## 5. Make the connection available to an agent

Reference the connector directly in `agent.yaml`:

```yaml
integrations:
  support:
    connector: tenant/support-desk
    tools:
      allow: [search_tickets]
```

Use the actual connector name and approved tools. Run `tanomis mcp connector tools CONNECTOR_ID`
to inspect them. Deploy the agent; there is no catalog association or connection-selection step.
See [the manifest reference](/reference/agent-manifest#governed-mcp-connectors).

## Where to go next

- [MCP connectors](/guides/connect-tools/mcp-connectors): workspace setup and runtime authorization.
- [Tool approvals and schema pins](/guides/connect-tools/tool-approvals-and-schema-pins): reviewed tool definitions.
- [`tanomis mcp connector`](/cli/mcp/connector): endpoint administration commands.