MCP servers

neondeck reads MCP server config from runtime-home mcp.json. Connected tools are registered with Flue as mcp__<server>__<tool> and appear in new Neon sessions after the registry refreshes.

Configuration

{
  "servers": {
    "linear": {
      "transport": "http",
      "url": "https://mcp.linear.app/mcp",
      "auth": { "kind": "oauth" }
    },
    "local-tools": {
      "transport": "stdio",
      "command": "node",
      "args": ["/absolute/path/to/server.mjs"],
      "tools": {
        "deny": ["dangerous_tool"]
      }
    }
  }
}

HTTP servers must use https:// except loopback development hosts. Raw secrets are rejected. Header auth uses environment-variable references, and OAuth tokens are stored only in data/neondeck.db.

{
  "servers": {
    "internal": {
      "transport": "http",
      "url": "https://mcp.example.com/mcp",
      "auth": {
        "kind": "header",
        "headers": {
          "Authorization": { "env": "INTERNAL_MCP_AUTHORIZATION" }
        }
      }
    }
  }
}

Approval policy

MCP tools default to per-call approval. Exact tool names can be denied or auto-approved per server:

{
  "tools": {
    "autoApprove": ["search"],
    "deny": ["delete_project"]
  }
}

Pending approvals are single-use and bound to the exact argument hash. Resolve them from Runtime Overview, the local API, or the CLI, then retry the same tool call with unchanged arguments.

OAuth

OAuth servers start in needs-login until a user completes a state-bound loopback authorization flow. The callback exchanges the authorization code through the MCP SDK provider and stores client registration, PKCE verifier, discovery state, and tokens in SQLite.

neondeck mcp add linear --url https://mcp.linear.app/mcp --oauth
neondeck mcp login linear
neondeck mcp logout linear --confirm

The dashboard Runtime Overview panel shows configured MCP servers, OAuth login/logout controls, tool counts, connection errors, and pending MCP approvals.

CLI and API

neondeck mcp list
neondeck mcp status [id]
neondeck mcp add <id> --url ... | --command ...
neondeck mcp enable <id>
neondeck mcp disable <id>
neondeck mcp tools <id>
neondeck mcp approvals [--resolve <id> --approve|--deny]
neondeck mcp audit

GET    /api/mcp/servers
POST   /api/mcp/servers
PATCH  /api/mcp/servers/:id
DELETE /api/mcp/servers/:id
GET    /api/mcp/servers/:id/tools
POST   /api/mcp/servers/:id/refresh
POST   /api/mcp/servers/:id/login
GET    /api/mcp/logins/:id
GET    /api/mcp/oauth/callback
POST   /api/mcp/servers/:id/logout
GET    /api/mcp/approvals
POST   /api/mcp/approvals/:id/resolve
GET    /api/mcp/audit

Agent boundary

Neon can use safe typed actions for HTTP/OAuth server setup and OAuth login starts. Stdio servers, header-authenticated servers, and auto-approval policy are user-owned surfaces because they can spawn host processes or forward environment-backed secrets. Configure those through the CLI, local API, or direct mcp.json edits.