Support MCP Connections

Connect your own data and diagnostic tools to mailbox investigations. Each workspace manages its connections, and each mailbox chooses which ones its investigator may use.

For example, an investigator can look up the sender's account, check recent launch attempts and logs, compare the evidence with the selected repository, and prepare a support draft. A successful lookup is evidence for an investigation; an email address alone does not establish account ownership.

Before you start

• Configure mailbox code consultation with a coding agent, support project and repository.
• Obtain your MCP server's public HTTPS endpoint and credentials.
• Use credentials limited to the records and read-only operations needed for support.
• You need permission to manage integrations to add, edit, test or delete connections.

This release supports remote Streamable HTTP MCP servers, including JSON and streaming responses. Local command servers and legacy standalone SSE endpoints are not supported.

Add a connection

1. Open Integrations → AI → Support MCP connections and select Add.
2. Enter a name and the HTTPS MCP endpoint. Put credentials in the authentication fields, not in the URL.
3. Choose the authentication method:
   • OAuth: Select Save and sign in and complete the server's consent screen. If automatic client registration is unavailable, register a client with the displayed OAuth callback URL, then enter its client ID and any required client secret. Enter scopes only when required by your server.
   • Bearer token: Enter the token, then select Save and test.
   • No authentication: Use this only for servers intended to be accessed without credentials, then select Save and test.
4. After the test succeeds, select the tools the investigator may use. Newly discovered tools are disabled until you select and save them. Tools explicitly marked as writable cannot be selected.
5. Add investigation instructions: what the tools contain, how to match a customer, and which evidence to collect.
6. Select Save.

Blank credential fields preserve existing values when editing the same connection. Changing the endpoint or credentials requires testing the connection and selecting its tools again.

Restrict a shared data server

A connection to a shared server may expose more data than a single mailbox should use. Restrict permissions at the data source, enable only the required tools, and use Fixed tool arguments where a tool accepts a source identifier.

For a server with a tool named query and an argument named source_id, the configuration could be:

{
  "query": {
    "source_id": "your-restricted-source-id"
  }
}

Use the actual tool and argument names shown by your server. Corcava overrides any conflicting agent input with these fixed values. Disable tools that list other sources or provide an alternative route to unrestricted data.

Tool descriptions and read-only labels are not access controls. A database account restricted to SELECT is what prevents database writes. Mailbox instructions guide the investigation but do not limit what a server credential can access.

Enable a connection for a mailbox

1. Open Integrations → Email, then edit the mailbox's automation settings.
2. Enable support automation and at least one output, such as a reply draft.
3. Configure the coding agent, support project and repository.
4. Under Support MCP connections, select the tested connections you want this mailbox to use.
5. Save.

Task creation can stay off when you only want drafts. This first version runs MCP investigations through the configured coding agent and repository.

What the investigator can do

Corcava starts an investigation when classification says code or external records are needed. The coding agent receives a temporary connection to Corcava's tool gateway. Upstream tokens stay in Corcava, and only selected tools are exposed.

The gateway applies fixed arguments, limits requests and expires access after 30 minutes. Retrying an investigation invalidates its previous tokens. Removing a mailbox selection, changing tool permissions, deleting the connection or ending the run stops further access.

Results can cite both repository files and tool evidence. The workflow prepares findings and support drafts for review; these tools do not add automatic email sending or code changes.

Troubleshooting

• Needs testing: Save and test the connection. After OAuth sign-in, select tools and save.
• Connection error: Check the endpoint and credentials. Reconnect OAuth if authorization expired.
• No selectable tools: Confirm the server exposes investigation tools. Writable tools are excluded.
• Connection unavailable in a mailbox: Remove the old selection or repair and test the connection.
• Investigation cannot obtain evidence: Check the enabled tools, fixed arguments and source permissions. Review the result before sending a reply.

Related

• Mailbox Code Consultation
• AI Assistant Integration