PrivateMind
Get API key

Custom connectors

Register your organisation's own MCP servers and REST APIs, and use them in chat.

Alongside the connectors PrivateMind curates, an org admin can register your organisation's own (external MCP servers and REST APIs) so that everyone in your org can use them in a conversation. This page is the end-to-end walkthrough.

Both kinds are external services reachable over HTTPS. PrivateMind connects to them over the network; there is nothing to install.

  • An MCP server speaks the Model Context Protocol (streamable-HTTP or SSE) and exposes its own set of tools.
  • A REST API is a plain HTTPS host. The assistant can make GET requests to any path on it. The origin is pinned and the verb cannot become a write.

Before you start

You need two things:

  1. You are an org admin. Registration lives under Organisation Settings. A regular member cannot see the page.
  2. The feature is on for your org. On the Organisation Settings page (/settings/org/settings), both of these must be On:
    • MCP Servers (the master switch)
    • Custom MCP Servers (allows your org to register its own connectors)

Once both are on, a Custom Connectors item appears in the settings sidebar.

Register a connector

Go to Settings, Custom Connectors (/settings/org/mcp-servers) and click Add connector. First choose the Type, then fill in the rest:

Field Notes
Type MCP server or REST API. This is fixed once saved.
Name A label your members will recognise, e.g. "Acme Docs".
Server URL / API base URL The MCP endpoint (e.g. https://mcp.example.com/mcp) or the API host (e.g. https://api.example.com). Must be HTTPS and a public host.
Server-Sent Events (SSE) (MCP only) Leave off for the modern streamable-HTTP transport. Turn on only if the server is SSE-only.
Requires OAuth (MCP only) Turn on only if the server is its own OAuth provider on the same host.

The URL is validated when you save: non-HTTPS URLs, and hosts that resolve to a private or internal address, are rejected. The check resolves the name and inspects the address it lands on, so a public-looking name that points inward is refused too.

For a REST API, the host is pinned and the assistant is limited to GET; it may read any path under that one host, but it can never write.

Each org can register up to 25 connectors.

What happens next: the status column

After you add a connector it moves through a short lifecycle. The Status badge tells you where it is:

Status Meaning
Pending Registered. The network path to it is being requested.
Provisioning The egress path is being opened and applied.
Active Ready. It is reachable and now appears in the Connectors Library for your org.
Failed The egress path could not be opened. Remove and retry, or contact the PrivateMind team.
Disabled Turned off by an admin. Members no longer see it.

The page refreshes on its own while a connector is settling, so you can watch it flip to Active without reloading.

Using a registered connector in chat

Once a connector is Active, it becomes an org connector any member can find:

  1. In a chat, open the + menu and choose Connectors (or open Connectors from the top of the app). Go to the Library tab.
  2. Registered connectors appear there, on by default. A member can:
    • Connect it, which moves it into their My Connectors and, where it needs a personal key, saves that key.
    • Leave it, if they don't want it in their own chats.
  3. Attach it to a conversation from the Connectors picker. The assistant can then call its tools (for a REST API, make GET requests to it).

To stop using a connector in a chat, open the Connectors pane at the top right of the conversation. Each attached connector there offers Remove from this chat (detach it from this conversation only) and Delete connector (remove it from your connectors entirely).

Managing connectors

On the Custom Connectors page each row has:

  • an Enabled switch, to turn a connector off for the whole org without deleting it. Turning it off withdraws its egress and removes the shared connector; turning it back on re-provisions it.
  • a Remove action, which deletes the registration and withdraws its access.

Security and limits

  • Trust. An external connector receives whatever a member sends it during a conversation. Register only services your organisation trusts.
  • Isolation. Each org's registered connectors are confined to their own hosts; one org can never reach another org's.
  • Private data. A registered connector is treated as untrusted external egress. If a conversation also holds a private, internal source, the external connector is dropped from that conversation to prevent internal data leaving.
  • Public HTTPS only. Hosts on localhost, private IPs, or plain HTTP are rejected at registration.
  • REST APIs are read-only. A registered API is pinned to one host and to GET; it can read but never write.

Troubleshooting

  • I can't see the Custom Connectors page. You must be an org admin, and both MCP Servers and Custom MCP Servers must be on in Organisation Settings.
  • My connector is stuck on Pending. Either MCP egress is not yet enabled for your environment (contact the PrivateMind team), or the host is unreachable.
  • It registered but a member can't find it. It only appears in the Connectors Library once it reaches Active. Check the status badge.

Where next