Skip to main content

​
Overview

The Custom connector lets you point Rootly AI at any OAuth-based MCP server that isn’t in the built-in catalog. This covers internal tools your team hosts, third-party services that expose MCP endpoints, and vendor integrations Rootly hasn’t shipped native support for yet. You provide the endpoint and the OAuth details. Rootly AI authorizes against your server, then calls tools you’ve explicitly allowlisted during investigations.
Unlike built-in connectors, the Custom connector does not filter write-capable tools server-side. Rootly AI can call any tool you allowlist — including tools that mutate state on your MCP server. Allowlist read-only tools unless you specifically want Rootly AI to be able to invoke a write.

​
Before You Start

  • A running MCP server reachable at a public HTTPS URL.
  • OAuth 2.0 configured on that server — Rootly AI authorizes via the standard OAuth flow, not with pre-shared credentials.
  • A list of tools you’re comfortable letting Rootly AI call. You control the allowlist explicitly.

​
Setup

1

Open the Custom connector card

Go to Configuration → AI → Connectors and click Connect on the Custom card.
2

Enter the MCP endpoint URL

Paste the public HTTPS URL of your MCP server (for example, https://mcp.your-company.com). It must be publicly reachable with a valid TLS certificate — private IPs and self-signed certs aren’t accepted.
3

Provide a display name

This is the label Rootly AI uses when citing the connector in investigations (e.g., “queried the internal-ops MCP”). Pick something responders will recognize.
4

Authorize via OAuth

Rootly AI redirects to your MCP server’s OAuth flow. Sign in on the vendor’s screen and grant access.
5

Allowlist tools

After authorization, Rootly AI discovers the tools your MCP server exposes. Pick the subset you’re comfortable letting Rootly AI call. Only allowlisted tools can be invoked during investigations.
Public HTTPS only. Rootly can’t reach an MCP server on a private network or via localhost. If your MCP is behind a VPN, expose it through a reverse proxy with a valid TLS certificate before connecting.

​
Managing the Connection

Open the Custom card’s Configure screen to:
  • Update the allowlist — narrow or expand which tools Rootly AI can call. Removing a tool takes effect on the next investigation.
  • Update the endpoint URL — if you move your MCP server, point Rootly at the new host. Rootly re-authorizes on save.
  • Rotate credentials — disconnect and reconnect to trigger a fresh OAuth flow. Old tokens are revoked.

​
Best Practices

  • Start with a minimal allowlist. Only whitelist the tools you’re sure Rootly AI should call. It’s easier to add later than to explain a surprise tool call.
  • Give the connector a descriptive display name. “Internal ops MCP” or “Finance data MCP” is more useful than “Custom” when Rootly AI cites it in an investigation summary.
  • Rotate on personnel changes. The OAuth grant is tied to whoever authorized it. When that person leaves, disconnect and reconnect from someone else’s account so the connection doesn’t die silently.
  • Prefer named connectors over Custom when a native one exists. If Rootly ships a first-class connector for what you’re doing, use it — first-class connectors get better UI, tighter tool sets, and validated setup.

​
Troubleshooting

The URL must be a public HTTPS endpoint with a valid TLS certificate. Private IPs, localhost, and self-signed certificates are rejected. Deploy behind a public gateway with a real cert.
Your MCP server has to expose a tool discovery endpoint that Rootly AI can call after OAuth completes. If your MCP implementation doesn’t return a tool list, Rootly can’t populate the allowlist. Confirm the MCP server’s discovery response with an independent MCP client.
Rootly AI only reaches for a tool when the current question actually needs it. If the tool isn’t showing up, it usually means the question didn’t warrant that lookup — not that the connector is broken. Try a prompt that explicitly targets the tool’s data.
If someone revokes the OAuth grant on the MCP server side, Rootly’s card still shows Connected but every query fails. Reconnect to trigger a fresh OAuth flow.

​
Frequently Asked Questions

Built-in connectors ship with dedicated setup UI, tested tool sets, and per-provider troubleshooting. The Custom connector is the escape hatch — point it at any OAuth-based MCP endpoint and provide your own allowlist. Use built-ins when they exist; use Custom when they don’t.
Yes. Each Custom connection is independent — different display name, different endpoint, different allowlist. Common for teams that expose one MCP per internal system.
Not today. The Custom connector requires OAuth 2.0 on the MCP server. If your MCP only exposes API-key auth, wrap it in an OAuth-capable gateway or contact support to request first-class API-key support.
Rootly AI can only call tools you allowlist — but what those tools do is defined by your MCP server, not by Rootly. Rootly doesn’t inspect a tool’s semantics or filter out write-capable tools automatically. Only allowlist tools you’re comfortable Rootly AI invoking, and prefer read-only operations for anything you don’t want Rootly AI to be able to mutate. Built-in connectors ship with a curated read-only tool set; the Custom connector puts that responsibility on you.

Connectors Overview

All connectors and how they fit together.

Data Privacy for Rootly AI

What Rootly AI sees, retention, and model training controls.

Grafana Managed

Another endpoint-based connector — good reference for public-HTTPS requirements.