Tools: MCP servers and webhook tools

Setting one up

• Add an MCP server from the palette and connect it to the orchestrator.
• Enter the server URL and choose HTTP (default) or SSE. Add an Authorization value if the server needs one.
• Press Fetch tools. Tick the tools the orchestrator may use; the counter shows how many your plan allows.
• Test in the playground. Tool calls appear in the trace as MCP tool entries with input and result.

Webhook tools (no server needed)

Add a Webhook tool from the palette and connect it to the orchestrator. Fill in: a description of when the agent should call it, the method and URL, an optional Authorization value, and the parameters the model must supply (name, type, description, required). Choose whether to wait for the response; if you do, the response body is handed back to the model so it can use the result.

Your endpoint receives JSON:

POST https://hooks.example.com/agent
Content-Type: application/json
X-Agent-Studio-Timestamp: 1790000000000
X-Agent-Studio-Signature: <hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

{ "tool": "Create ticket", "agent": "Support Copilot", "args": { "email": "a@b.co", "summary": "Login fails on iOS" }, "sentAt": "2026-09-28T10:00:00.000Z" }

For GET, the parameters are sent as query string values and the signature covers the timestamp only. Verify the signature with the shared secret from your account settings if you need to trust the caller; the header alone tells you the request came through Agent Studio. Responses are truncated to 4,000 characters; a non-2xx status is returned to the model as an error it can explain.

Each webhook tool counts as one tool against the plan limit below, alongside enabled MCP tools.

Limits by plan

The limit counts enabled MCP tools plus webhook tools connected to one agent. Saving, deploying, the playground and the public API all enforce it; after a downgrade, deployments over the new limit pause until redeployed. See pricing.

Security

• Server URLs are checked before every connection: only public http(s) hosts; loopback, private ranges, link-local and cloud metadata addresses are refused, and redirects are not followed.
• Credentials belong in the Authorization field, never in the URL.
• The orchestrator only sees the tools you enabled, under a name prefixed with the server, so tools from different servers cannot collide.
• A server that is down does not fail the run: the trace records the connection error and the agent answers without those tools.

What the trace shows

{ "stage": "tool", "server": "CRM", "tool": "find_customer", "input": "{"email":"a@b.co"}", "result": "{"id":"c_123","plan":"pro"}", "ok": true, "ms": 412 }