Register and manage MCP servers that Sidecar agents can use
Register an MCP server at the workspace level before granting it to an Agent Console agent. You can connect a custom endpoint or enable MCP for a supported native integration.
This workflow connects external MCP servers to Sidecar agents. To connect the
Sidecar MCP server to an external AI client, see Use Sidecar MCP in an AI
client.
You must be an Account Admin to manage MCP servers.
Sidecar’s custom connector expects the exact MCP endpoint URL to:
Support the MCP Streamable HTTP transport
Be reachable from Sidecar’s infrastructure
Accept a static token in the Authorization: Bearer <token> header
Support MCP initialization and tools/list
Respond to connection checks within 30 seconds
Use HTTPS for every production endpoint. A local stdio command, an SSE-only
URL, or a server that requires an interactive OAuth flow cannot be registered
directly.
Choose a native connector or add a custom MCP server.
Choose a setup method.
Custom server
Snowflake
dbt Cloud
Select Custom server, then enter:
Display name — the label people see in Sidecar
Name — a stable machine-readable name
Server URL — the full Streamable HTTP MCP endpoint
Bearer token — the workspace credential Sidecar sends to the server
Click Add server.
Use a stable name, the complete HTTPS endpoint, and a write-only bearer token.
Connect Snowflake first. In Add MCP, select Snowflake to open its MCP setup.Paste a programmatic access token for a Snowflake service user. Do not use a personal token. Sidecar derives the server URL from the integration.
Connect dbt Cloud first. In Add MCP, select dbt Cloud to open its MCP setup.Paste an organization-wide dbt Cloud service token. Do not use a personal token. Sidecar derives the server URL from the integration.
BigQuery, Databricks, and Redshift appear as coming soon for native MCP setup.
You can still register a compatible endpoint as a custom server. Follow the
warehouse-specific guides above for supported endpoints and authentication
constraints.
Sidecar stores the token as a write-only workspace credential, probes the endpoint, and requests its tool list. The token is never displayed again.The server row is saved even when the initial probe reports an authentication or reachability warning. Resolve the warning before depending on the server in a job.
Check now — check endpoint reachability without retrieving the stored credential
Refresh tools — re-enter the token and request the tool list again
Replace token — replace the write-only credential and repeat tool discovery
Edit — change a custom server’s display name or URL
Delete — remove the server from the workspace
Check now confirms reachability. Because Sidecar cannot read the stored
token back, this check does not prove that the credential is valid. Use
Refresh tools to test with a token.
Changing a custom server URL requires you to re-enter its bearer token. URLs derived from Snowflake or dbt Cloud are not editable.
Deleting a server removes its agent grants, job selections, and
tool-permission exceptions.