Add an MCP server

Adding an MCP server takes four steps: Details, Tools, Activate and Connect. An organization that is billed outside MCP Tower skips Activate. Every step has a Help link back to this page, a Back link to the step before, and Next to move on.

Details

Details asks for two addresses.

Origin URL (current): the full, original web address where your MCP server runs today, for example https://mcp-origin.example.com/mcp. MCP Tower scans this URL and forwards agents’ requests to it. It must be reachable from the internet over HTTPS.
Public MCP URL (desired): the address agents will connect to. It always starts with https://, and MCP Tower suggests https://mcp.<your domain>/ from the origin, for example https://mcp.example.com/ for https://mcp-origin.example.com/mcp. We recommend a bare hostname with no path. A path is accepted when your server needs one, and it may differ from the origin’s (see Publish a different path).

The public hostname must differ from the origin’s. Once it points at MCP Tower, MCP Tower answers on it and forwards every request to the origin, so the origin needs a name of its own.

Your organization is named after the domain of your first server’s origin, for example example for https://mcp-origin.example.com/mcp. An Admin can rename it in Organization settings.

My server already runs on the hostname I want to publish

Once the hostname points at MCP Tower it can no longer reach your server directly, so the two need different names.

Expose your server under a second name, for example mcp-origin.example.com.
Enter that URL as the origin URL, and your current URL as the public MCP URL.
Move the DNS record in the Connect step. Agents keep using the same hostname.

Tools

Tools starts as soon as Details is saved: MCP Tower scans the origin and lists its tools. While the scan runs, the list is covered by “Scanning your MCP server…” and Next waits.

Every tool call is tracked. For each tool you choose which argument values are tracked, with the Track value switch in its arguments. Every switch starts off; track only values you are allowed to keep.

Each tool shows the tags that apply to it: Sign-in required, Read-only, Destructive, Idempotent and Closed world, from the hints the server declares. Raw, on the same line, shows the tool’s definition exactly as the server sent it.

The server requires authentication

When the server lists no tools without a sign-in, the step says “Looks like the MCP server requires authentication to return the list of tools”. Choose Sign in to scan and sign in as you would in an agent. MCP Tower keeps your token, encrypted, for later scans, and scans again. If your provider doesn’t let MCP Tower register itself, register a client with it using the redirect URI the step shows, then enter its client id and secret.

You can also continue without signing in: tools that appear later are tracked too.

The scan failed

When MCP Tower can’t reach the origin, or it doesn’t answer as an MCP server, the step says why, with Scan again and a link back to Details to fix the origin URL. Setup can’t continue until a scan succeeds or asks for a sign-in.

Activate

Choose monthly or annual billing, whether to buy another 100,000 tool calls automatically when the quota is reached (with an optional monthly limit), and the card to charge. Nothing is charged in this step: the card is charged once the server is connected, and the plan is covered by our 30-day money-back guarantee. A declined card keeps you on the step. See pricing.

Connect

Opening Connect creates your hostname in MCP Tower and shows straight away:

The DNS records to add at your DNS provider: a CNAME record for your public hostname, and any validation records Cloudflare asks for.
The origin secret, which MCP Tower sends to your origin as X-MCP-Tower-Origin-Secret on every request. Configure your origin to reject requests without it; see the origin secret. Copy it now: it is shown until the server is connected, and never after.
The two Cloudflare statuses, for the hostname and its certificate.

Choose Check once the DNS record is in place, or leave the step open: it checks by itself every 30 seconds. If something is still pending, the step says what. Once both statuses are active, the server is live and the step opens Inspect.

Connect automatically

When your domain’s DNS provider supports Domain Connect and has approved MCP Tower, Connect shows Connect automatically above the DNS records. It takes you to your DNS provider, which asks you to sign in and shows the record it will add: the same CNAME to cname.mcptower.io. Confirm there, and you come back to Connect, which checks the hostname at once. MCP Tower never gets access to your DNS account.

Providers. Cloudflare for now. Other providers are added as they approve MCP Tower; until then, add the record yourself as above.
The record replaces what is there. Any record already on your public hostname is removed. If your MCP server lives on that hostname today, move it to an origin hostname first (see above).
Validation records that Cloudflare asks for, if any, stay manual: add them yourself.
Proxied on Cloudflare. The record Cloudflare adds is proxied (orange cloud), so your zone’s own Cloudflare features run first, then MCP Tower’s. Your WAF, bot protection (such as Bot Fight Mode) and redirect rules then apply to agent traffic: make sure they let AI agents through, and let /.well-known/acme-challenge/ through so the certificate can be issued. To skip your zone’s rules, open the record in your Cloudflare dashboard, DNS, Records, and switch its proxy status to DNS only.

While a server is connecting, Inspect is unavailable to everyone in your organization: users who can edit are taken to its Connect step, and Viewers see which server is being connected. Finish the DNS record to bring Inspect back.