Add remote MCP servers to Last9 AI

Connect Last9 AI to a remote MCP server your organization runs (for example an internal incident, payments, or ticketing MCP). After registration, tools from that server are available on the next activated chat turn. To make the assistant prefer those tools during investigations, bind them on a knowledge topic.

This page covers organization MCP management for Last9 AI. For connecting a coding agent to Last9’s hosted MCP, see Last9 MCP.

Prerequisites

• Last9 AI enabled for your organization. See Enable Last9 AI.
• An Admin user (writes and MCP diagnostics need an administrator).
• An API refresh token with write scope to create or update, and delete scope to remove servers. See Getting started with API.
• Your remote MCP endpoint reachable from Last9 over HTTPS, with any auth headers you will store on the server record.
• Your organization slug (from the dashboard URL: app.last9.io/v2/organizations/<org_slug>/...).

Register a remote MCP server

Worked example name: payments. Substitute your server name, URL, and credentials.

1. Mint an access token

   Exchange a refresh token that includes write (and delete if you need cleanup):

   curl -sS -X POST 'https://app.last9.io/api/v4/oauth/access_token' \
     -H 'Content-Type: application/json' \
     -d '{"refresh_token":"<refresh_token>"}'

   Export the access token:

   export LAST9_TOKEN='<access_token>'
   export LAST9_ORG='<org_slug>'
   export LAST9_AI="https://app.last9.io/api/v4/organizations/${LAST9_ORG}/ai"

2. Probe the remote MCP without saving

   Confirm connectivity and tool discovery before you persist configuration. A failed diagnostic does not create a server.

   curl -sS -X POST "${LAST9_AI}/mcp-servers/test" \
     -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}" \
     -H 'Content-Type: application/json' \
     -d '{
       "name": "payments",
       "transport": "streamablehttp",
       "url": "https://mcp.example.com/mcp",
       "headers": {"Authorization": "Bearer <mcp_credential>"}
     }'

   Use transport: "sse" only if your server speaks SSE instead of Streamable HTTP. Fix URL or credentials until the diagnostic succeeds. Do not save an unreachable server — a bad saved server can block new chat turns until you fix or delete it.

   You can also probe a saved server with POST ${LAST9_AI}/mcp-servers/payments/test (no body required for the named route when the server already exists).

3. Register the MCP server

   curl -sS -X POST "${LAST9_AI}/mcp-servers" \
     -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}" \
     -H 'Content-Type: application/json' \
     -d '{
       "name": "payments",
       "transport": "streamablehttp",
       "url": "https://mcp.example.com/mcp",
       "headers": {"Authorization": "Bearer <mcp_credential>"}
     }'

   Expected: 201 with activation.status: "pending". Responses list header names and whether auth is configured — never secret values. Header values are stored as literal strings (they are not expanded from environment variables).

   Server name must match [a-z][a-z0-9_-]{0,99} (lowercase, start with a letter). The name test is reserved because POST /mcp-servers/test is the diagnostic route. The URL must be https://.

4. List and read servers

   curl -sS "${LAST9_AI}/mcp-servers" \
     -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}"
   
   curl -sS -D - "${LAST9_AI}/mcp-servers/payments" \
     -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}" -o /tmp/mcp-payments.json

   Keep the quoted ETag from the GET response for later PATCH or DELETE. Deployment-managed servers (such as Last9’s own MCP) appear in the list but cannot be mutated or tested through these routes.

5. Activate with a chat turn

   There is no separate activate endpoint. After create or PATCH, activation.status is pending. Open AI Assistant and send a turn, then check:

   curl -sS "${LAST9_AI}/config/status" \
     -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}"

   Expect active. If activation fails (bad MCP URL or auth), new turns stay blocked until you fix or delete the server.

How tools appear after activation

Creating an MCP server alone does not make the model prefer those tools. Register the server here, then bind tools on a knowledge topic with use: ["incident_triage"] and put the procedure in the topic overview. Prefer topic-prefixed tools in runbooks so auto approval applies where you configured it.

Update or remove

Read the server first and keep the quoted ETag. Send it as If-Match on PATCH or DELETE. Missing If-Match returns 428; a stale value returns 412.

curl -sS -X PATCH "${LAST9_AI}/mcp-servers/payments" \
  -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}" \
  -H 'Content-Type: application/json' \
  -H 'If-Match: "<etag_from_get>"' \
  -d '{"url":"https://mcp.example.com/mcp/v2"}'

Omit headers on PATCH to keep existing credentials; send "headers": {} to clear them.

Delete (needs delete scope on the token):

curl -sS -X DELETE "${LAST9_AI}/mcp-servers/payments" \
  -H "X-LAST9-API-TOKEN: Bearer ${LAST9_TOKEN}" \
  -H 'If-Match: "<etag>"'

Checklist

1. Admin has AI enabled and an API refresh token with write and delete scopes.
2. POST /mcp-servers/test succeeds against the real HTTPS MCP URL and credentials.
3. POST /mcp-servers returns 201 and the server appears in GET /mcp-servers.
4. After one AI Assistant turn, GET /config/status is active.
5. A test chat can request mcp__payments__… (expects approval) or a topic-bound {topic}__… tool.
6. Unreachable test servers are deleted so they cannot leave config stuck pending or failed.
7. For investigations, continue with knowledge topics to bind tools and upload runbooks.

Related

• Knowledge topics — runbooks, incident_triage, and MCP tool bindings
• AI Assistant — run a verification chat after activation
• Last9 MCP — hosted Last9 tools for coding agents
• Getting started with API — refresh and access tokens

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.