> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom (Any OAuth MCP)

> Bring your own OAuth-based MCP server as a Rootly AI connector — with an allowlist of tools it can call during investigations.

## Overview

The **Custom** connector lets you point Rootly AI at any OAuth-based MCP server that isn't in the built-in catalog. This covers internal tools your team hosts, third-party services that expose MCP endpoints, and vendor integrations Rootly hasn't shipped native support for yet.

You provide the endpoint and the OAuth details. Rootly AI authorizes against your server, then calls tools you've explicitly allowlisted during investigations.

<Warning>
  Unlike built-in connectors, the Custom connector does **not** filter write-capable tools server-side. Rootly AI can call any tool you allowlist — including tools that mutate state on your MCP server. Allowlist read-only tools unless you specifically want Rootly AI to be able to invoke a write.
</Warning>

***

## Before You Start

* **A running MCP server** reachable at a public HTTPS URL.
* **OAuth 2.0** configured on that server — Rootly AI authorizes via the standard OAuth flow, not with pre-shared credentials.
* **A list of tools** you're comfortable letting Rootly AI call. You control the allowlist explicitly.

***

## Setup

<Steps>
  <Step title="Open the Custom connector card">
    Go to **Configuration → AI → Connectors** and click **Connect** on the **Custom** card.
  </Step>

  <Step title="Enter the MCP endpoint URL">
    Paste the public HTTPS URL of your MCP server (for example, `https://mcp.your-company.com`). It must be publicly reachable with a valid TLS certificate — private IPs and self-signed certs aren't accepted.
  </Step>

  <Step title="Provide a display name">
    This is the label Rootly AI uses when citing the connector in investigations (e.g., *"queried the internal-ops MCP"*). Pick something responders will recognize.
  </Step>

  <Step title="Authorize via OAuth">
    Rootly AI redirects to your MCP server's OAuth flow. Sign in on the vendor's screen and grant access.
  </Step>

  <Step title="Allowlist tools">
    After authorization, Rootly AI discovers the tools your MCP server exposes. Pick the subset you're comfortable letting Rootly AI call. Only allowlisted tools can be invoked during investigations.
  </Step>
</Steps>

<Warning>
  **Public HTTPS only.** Rootly can't reach an MCP server on a private network or via `localhost`. If your MCP is behind a VPN, expose it through a reverse proxy with a valid TLS certificate before connecting.
</Warning>

***

## Managing the Connection

Open the Custom card's **Configure** screen to:

* **Update the allowlist** — narrow or expand which tools Rootly AI can call. Removing a tool takes effect on the next investigation.
* **Update the endpoint URL** — if you move your MCP server, point Rootly at the new host. Rootly re-authorizes on save.
* **Rotate credentials** — disconnect and reconnect to trigger a fresh OAuth flow. Old tokens are revoked.

***

## Best Practices

* **Start with a minimal allowlist.** Only whitelist the tools you're sure Rootly AI should call. It's easier to add later than to explain a surprise tool call.
* **Give the connector a descriptive display name.** *"Internal ops MCP"* or *"Finance data MCP"* is more useful than *"Custom"* when Rootly AI cites it in an investigation summary.
* **Rotate on personnel changes.** The OAuth grant is tied to whoever authorized it. When that person leaves, disconnect and reconnect from someone else's account so the connection doesn't die silently.
* **Prefer named connectors over Custom when a native one exists.** If Rootly ships a first-class connector for what you're doing, use it — first-class connectors get better UI, tighter tool sets, and validated setup.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Save fails with 'endpoint not reachable'" icon="triangle-exclamation">
    The URL must be a public HTTPS endpoint with a valid TLS certificate. Private IPs, `localhost`, and self-signed certificates are rejected. Deploy behind a public gateway with a real cert.
  </Accordion>

  <Accordion title="Authorization succeeds but no tools appear in the allowlist" icon="magnifying-glass">
    Your MCP server has to expose a tool discovery endpoint that Rootly AI can call after OAuth completes. If your MCP implementation doesn't return a tool list, Rootly can't populate the allowlist. Confirm the MCP server's discovery response with an independent MCP client.
  </Accordion>

  <Accordion title="A tool I allowlisted isn't being called during investigations" icon="circle-question">
    Rootly AI only reaches for a tool when the current question actually needs it. If the tool isn't showing up, it usually means the question didn't warrant that lookup — not that the connector is broken. Try a prompt that explicitly targets the tool's data.
  </Accordion>

  <Accordion title="Disconnected on the vendor side" icon="plug-circle-xmark">
    If someone revokes the OAuth grant on the MCP server side, Rootly's card still shows Connected but every query fails. Reconnect to trigger a fresh OAuth flow.
  </Accordion>
</AccordionGroup>

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="How is Custom different from the built-in connectors?" icon="shapes">
    Built-in connectors ship with dedicated setup UI, tested tool sets, and per-provider troubleshooting. The Custom connector is the escape hatch — point it at any OAuth-based MCP endpoint and provide your own allowlist. Use built-ins when they exist; use Custom when they don't.
  </Accordion>

  <Accordion title="Can I connect multiple Custom MCP endpoints?" icon="link">
    Yes. Each Custom connection is independent — different display name, different endpoint, different allowlist. Common for teams that expose one MCP per internal system.
  </Accordion>

  <Accordion title="Does the Custom connector support API keys instead of OAuth?" icon="key">
    Not today. The Custom connector requires OAuth 2.0 on the MCP server. If your MCP only exposes API-key auth, wrap it in an OAuth-capable gateway or contact support to request first-class API-key support.
  </Accordion>

  <Accordion title="Can Rootly AI write via a Custom connector?" icon="pen">
    Rootly AI can only call tools you allowlist — but *what those tools do* is defined by your MCP server, not by Rootly. Rootly doesn't inspect a tool's semantics or filter out write-capable tools automatically. **Only allowlist tools you're comfortable Rootly AI invoking**, and prefer read-only operations for anything you don't want Rootly AI to be able to mutate. Built-in connectors ship with a curated read-only tool set; the Custom connector puts that responsibility on you.
  </Accordion>
</AccordionGroup>

***

## Related Pages

<CardGroup cols={3}>
  <Card title="Connectors Overview" icon="sparkles" href="/ai/connectors/overview">
    All connectors and how they fit together.
  </Card>

  <Card title="Data Privacy for Rootly AI" icon="shield" href="/ai/data-privacy-for-rootly-ai">
    What Rootly AI sees, retention, and model training controls.
  </Card>

  <Card title="Grafana Managed" icon="chart-line" href="/ai/connectors/grafana-managed">
    Another endpoint-based connector — good reference for public-HTTPS requirements.
  </Card>
</CardGroup>