Skip to main content
The Model Context Protocol is an open standard for tool servers, with a growing ecosystem covering databases, APIs, and cloud services. IronClaw adapts MCP tools into agent capabilities. MCP is one of the runtimes an extension can declare, alongside WASM and first-party. An MCP server reaches your agent by being packaged as an extension whose manifest declares its tools and endpoint — there is no separate MCP server registry.

​
Adding a Server

Install and activate the extension that wraps the MCP server:
Then complete any credential setup from Extensions in the web interface. Once activated, the server’s tools appear alongside every other tool the agent can call. Remove it the same way you remove any extension:

​
Transport

IronClaw connects to MCP servers over HTTP(S) using JSON-RPC 2.0.
The stdio transport is not supported. IronClaw rejects it rather than spawning a local server process, because process-level egress controls have not landed yet. A server that only speaks stdio cannot be connected today.

​
Security

MCP servers are untrusted. A server does not gain ambient filesystem, secret, or network authority just because the agent can call its tools:
  • Calls go through the host-selected client, which is the only integration point
  • Outbound requests are planned and authorized by the host’s egress controls, not by the server
  • Resource use is accounted through the host governor like any other capability
  • Credentials are injected at the egress boundary and redacted from results and errors
See Security and Sandboxed Tools.

​
WASM or MCP?

Prefer a WASM extension when you’re writing the tool yourself and want it sandboxed. Use MCP when the tool already exists as an MCP server. See Building an Extension.