How do I add a custom MCP server to Grok Bot?
Last checked October 28, 2026 · Grok Bot changes often
Add it as a remote MCP server from Settings → Plugins (also reachable through Connect apps) and attach it to a task with @ in chat. Grok Bot connectors authenticate with OAuth; staff said in September 2026 there is no safe place to enter secret custom headers, and local stdio servers do not attach. If sign-in fails with "redirect_uri not allowed", your server must accept the client's registered redirect URIs, including a cursor:// callback.
Basics
- Grok Bot supports connectors and MCP. Add them under Settings → Plugins; once added, use
@in chat to bring one into a task. - Grok Bot runs on a cloud computer, so it needs a remote MCP server it can reach over HTTPS. Local stdio servers on your laptop do not attach.
- Custom MCP servers are not carried by templates. Anyone installing your template must add the server themselves.
Authentication: OAuth, not secret headers
Staff clarified in September 2026: connectors authenticate only via OAuth. Tokens are stored on the connector backend and the Bot calls tools without seeing them. There is no owner-only secrets form for arbitrary headers, so pasting an API key into chat to build a header is not safe — it stays in the Bot's history.
Some third-party vendors document header-based keys for their Grok Bot connectors; prefer their OAuth option if they offer one.
"redirect_uri not allowed"
During Dynamic Client Registration the client registers several redirect URIs, which staff listed:
cursor://anysphere.cursor-mcp/oauth/callbackhttps://www.cursor.com/agents/mcp/oauth/callbackhttp://localhost:8787/callback
Servers that only accept https or loopback redirects reject the whole registration because of the cursor:// entry.
- Cloudflare Access: a user found you can add
cursor://anysphere.cursor-mcp/oauth/callbackto the application's allowed URIs through the Access Applications API, even though the dashboard form does not allow it. Staff marked this as the solution. - Home Assistant via Nabu Casa: no setting to allow a custom scheme; no workaround as of October 2026.
Other OAuth errors seen on the forum — Dynamic client registration is disabled (Railway), localhost callbacks rejected (Zoom) — are provider-side settings to raise with that provider.