> ## Documentation Index > Fetch the complete documentation index at: https://developers.semji.com/llms.txt > Use this file to discover all available pages before exploring further. # Connect a custom MCP server to Semji > Bring your own MCP server — a custom CMS bridge or any internal tool — and let Semji's AI agents use its tools via OAuth or an API key. Beyond the built-in CMS integrations, Semji can connect to **any MCP server you host** — a bridge to a custom CMS, an internal tool, or a third-party service. You register the server once for the workspace, connect it with OAuth or an API key, then enable it on the AI agents that should use its tools. ## Requirements for your MCP server * Served over **HTTPS** and reachable from the **public internet** — servers on private networks cannot be connected. * Speaks the MCP **streamable HTTP** transport. * **If you use OAuth**, the server must implement the MCP authorization specification: * It advertises its protected-resource metadata (RFC 9728) — either via a `WWW-Authenticate` header on unauthenticated requests or at `/.well-known/oauth-protected-resource`. * Its authorization server publishes standard discovery metadata (RFC 8414 or OpenID Connect discovery). * Its authorization server supports **Dynamic Client Registration** (RFC 7591) — Semji registers itself automatically; manually pre-registered client IDs are not supported. * It accepts the redirect URI `https://app.semji.com/integrations/mcp/callback`. * **If you use an API key**, the server must accept it as `Authorization: Bearer ` on every request. ## Add the server In Semji, go to **Settings → Integrations**, open the **MCP** tab, and click **Add server**. You must be a **workspace owner**. Fill in the form: * **Name** — a display name; agents see it as the server's name. * **Description** — optional. * **URL** — the HTTPS URL of your MCP server, e.g. `https://mcp.example.com`. The URL cannot be changed after creation. * **Authentication method** — **OAuth** (sign in through the provider's consent screen) or **API key** (paste a token). With API key, paste it into the **API key** field. Click **Connect**. * **OAuth**: a new tab opens on your provider's consent screen — sign in and approve within 10 minutes. * **API key**: the key is stored immediately, without a live test against your server. Back on the MCP tab, the server row shows its status: **Connected**, **Not connected**, or **Expired**. Open the agent's configuration, go to **Enhancements → Custom MCP Servers**, and toggle your server on. The agent discovers the server's tools at run time. Depending on your Semji configuration, connections are shared by the whole workspace or made per user ("Each team member connects their own account."). With per-user connections, each teammate connects from the MCP tab or from their profile settings; agents silently skip servers the current user hasn't connected, and the chat shows *"You are not connected to …. Connect it to let this agent use it."* ## Manage the server From the MCP tab, each server row offers: * **Connect / Disconnect** — manage the stored credentials. * **Edit** — change the name and description (the URL is immutable; to change it, delete the server and add it again). * **Delete** — permanently removes the server from the workspace; every connected member loses access. ## Firewalls and IP allowlisting Your MCP server must be reachable from the public internet. Semji's own servers call it for connection and OAuth flows (discovery, client registration, token exchange): Semji's servers reach the internet through a fixed set of outbound IP addresses. If a firewall, WAF, or anti-bot protection (Cloudflare, Akamai, Sucuri, …) sits in front of your site, it can block Semji's requests — typically with a `403 Forbidden` — before they ever reach your CMS, even when your credentials are correct. Allow the following Semji IP addresses: ```text theme={null} 63.34.75.122 63.35.78.179 54.228.104.165 18.200.156.37 34.248.117.83 52.213.28.177 ``` Do **not** restrict access to your MCP server to the IP list above alone. AI agent tool calls are executed from Semji's AI provider infrastructure, whose addresses are not fixed — rely on OAuth or the API key for authentication, and use the IP list to exempt Semji from WAF or anti-bot challenges rather than as an exclusive allowlist. ## Troubleshooting Semji discovers your server's OAuth configuration live. Frequent causes, surfaced with explicit error messages: * The server does not support **Dynamic Client Registration** (RFC 7591) — pre-registered clients are not supported. * The protected-resource metadata is missing or declares no authorization servers. * The authorization-server metadata lacks an `authorization_endpoint` or `token_endpoint`, or is not served over HTTPS. * Discovery requests time out (10-second limit per request). Allow popups for the Semji app domain and connect again. The server's authorization stopped accepting Semji's stored credentials (for OAuth, the refresh token was rejected). Click **Connect** to re-authenticate; API-key servers ask for the key again. * The server isn't enabled on the agent (**Enhancements → Custom MCP Servers**). * The server isn't connected for the current user (per-user mode) or the workspace. * The API key is wrong — it is stored without a live test, so a bad key only surfaces at run time. * A firewall blocks tool calls (see the firewall section above). Each URL can only be registered once per workspace. Reuse the existing server, or delete it first if you need to recreate it. ## Related * [Semji's own MCP server](/mcp/overview) — the reverse direction: use Semji's tools from Claude and other assistants.