---
title: "Connect an MCP server"
method: POST
path: "/server-connections"
tags: ["Server connections"]
---

# Connect an MCP server

`POST /server-connections`

Starts a connection request for an MCP server URL. Discovery, browser consent, and validation happen asynchronously; poll the returned `connectionRequestId` until the status is terminal. When the next step belongs to a person, the response carries a `handoffUrl` to open.

## Request body

- ServerConnectionCreateBody
  - `url` string, required — The MCP server URL to connect.
  - `projectId` string — Omit to have the user choose in the browser; a request with no project resolves to `awaiting_project` rather than defaulting to one.
  - `serverId` string — Disambiguates when a project already has several saved servers on this URL.
  - `name` string — Used only if a server row is created. Ignored when an existing row is reused.
  - `reauthorize` boolean — Skip deduplication and force a fresh authorization.

## Response `201`

Connection request created.

- ServerConnection — The state of one "connect this MCP server" request. Every server-connection route returns this shape, so a caller polls exactly what it created.
  - `connectionRequestId` string, required — Public `scr_…` identifier. Safe to print; it is never sufficient to act on a request.
  - `status` 'discovering' | 'awaiting_project' | 'awaiting_authorization' | 'authorizing' | 'validating' | 'ready' | 'failed' | 'expired' | 'cancelled', required
  - `handoffUrl` string — Where the user finishes in a browser, for both `awaiting_project` and `awaiting_authorization`. Returned ONLY by the create call — the raw token behind it is minted once and never stored. Treat it as a private, single-person capability: never post it to a shared channel.
  - `expiresAt` string, date-time, required
  - `projectId` string
  - `serverId` string
  - `server` object
    - `id` string
    - `name` string
    - `url` string — Redacted: query values are replaced, because a keyed-endpoint URL's query can be the credential.
    - `enabled` boolean
  - `error` object
    - `code` string
    - `message` string
    - `retryable` boolean — Whether retrying THIS request could succeed.
    - `candidates` object[] — Present only on AMBIGUOUS_SERVER: the saved servers the URL matched, so the caller can re-send with a serverId.
      - `id` string
      - `name` string
      - `url` string

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `409` — The resource is not in a state that accepts this write — a stale `expectedRevision`, a duplicate name, or an environment that cannot currently be launched. The request was well-formed; re-read the resource and retry.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.

---

[API](https://skmtc.net/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.net/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/41898cb1a9f2/schema)