Both kinds follow the same tool snapshot, allowlist and approval rules.
Serve MCP from your app
src/app.ts
addMcp takes any fetch-style MCP handler: a function (request, extra?) => Response, or an object
with such a fetch method. See Server handlers. An app has at most one MCP server.
The manifest records that URL and the
auth mode. A deploy is refused with mcp-host-unverified when
the URL’s host isn’t covered by one of the app’s verified domains;
private apps, and hosted apps serving MCP on their own <slug>.reintersect.app host, are exempt.
Adding or changing the server changes the app’s access, so installs wait for an admin to approve the
new version.
Tools
When a server is added, Reintersect connects with an admin’s credentials, lists the server’s tools and stores a snapshot: names, descriptions, input schemas and annotations. The admin chooses which tools members can use. Tools the admin leaves out are never offered to the agent. Each tool the agent sees is namedmcp_<server>__<tool>, at most 64 characters, so two servers with a
search tool don’t collide. Tool descriptions and results are passed to the model as data from
that server, never as instructions.
Approval
Admins can override each tool in the server’s settings: ask first, always ask, or run without asking.
The circle agent, which runs without a member watching, only gets tools that run without asking.
When the tool list changes
Reintersect refreshes the snapshot when the server’s cache hint (ttlMs) expires and when a call
fails because a tool no longer exists or the cached view is out of date. A new tool, or a tool that
loses readOnlyHint, is held until an admin reviews it.
Asking the member for input
When a tool needs more input mid-call (an MCPelicitation/create form request), the agent shows the
form in the chat to the member who started the turn. Reintersect sends the answers back and retries
the call, up to three rounds, within 15 minutes. Requests whose fields look like they ask for a
password, token or other secret are refused, and messages are capped at 500 characters. The circle
agent can’t answer input requests.
What your server receives
Tool calls arrive as normal MCP requests with the member’s credential. See Authentication for how that credential is obtained. Don’t trust anything in the request’s_meta for authorization; use the verified token.
Protocol support
Reintersect’s MCP client is the official TypeScript client, and connects to servers on the current protocol revision and earlier ones that support Streamable HTTP. Every request to a server goes through Reintersect’s SSRF guard: private, loopback and link-local addresses are refused. MCP Apps, theui:// resources that render inside an iframe, aren’t supported, and tool results
can’t carry blocks. To show interactive UI, give the agent an
insert tool by making a block insertable.
Next steps
Authentication
Bring your own OAuth, or let Reintersect sign each call.
Server handlers
Mount the official SDK or any fetch-style handler with addMcp.
Agents
How the agent reads, inserts and acts on blocks.