Custom MCP server

Custom

Add any remote MCP server that isn’t in the Catalog, then route its traffic through Formal to control and log what AI agents do with it:

Block risky tools, such as delete_record.
Mask emails and phone numbers in search_records responses.
Keep credentials at the Connector, so users and agents never see them.
Log every tool call with the user, MCP client, and parameters.

0. Prepare your Connector

The Connector needs an MCP listener and a hostname with wildcard DNS and TLS. Set them up once by following Deploy the Connector. Every MCP server reuses them.

1. Add your custom MCP server to your Resources

UI
Terraform
Pulumi
API

Go to the Admin Catalog and click Add MCP.
Click Add Custom.
Paste https://mcp.internal.example.com/mcp into URL.
Enter internal-tools in Name. Formal uses it as the server’s subdomain on the Connector.
Choose the Space containing your Connector.
Choose Authentication, then click Add to Catalog.

Use a valid DNS label with lowercase letters, digits, and hyphens. Names can contain up to 63 characters.

Set space_id to the ID of the Space containing your Connector.

resource "formal_resource" "internal_tools" {
  name                    = "internal-tools"
  technology              = "mcp"
  hostname                = "mcp.internal.example.com"
  space_id                = "<SPACE_ID>"
  native_users_v3_enabled = true
  port                    = 443
  tags = {
    "mcp-endpoint" = "/mcp"
  }
}

resource "formal_resource_oauth_settings" "internal_tools" {
  resource_id = formal_resource.internal_tools.id
}

Set spaceId to the ID of the Space containing your Connector.

import * as formal from "@formalco/pulumi";

const resource = new formal.Resource("mcp", {
  name: "internal-tools",
  technology: "mcp",
  hostname: "mcp.internal.example.com",
  port: 443,
  spaceId: "<SPACE_ID>",
  tags: { "mcp-endpoint": "/mcp" },
  nativeUsersV3Enabled: true,
});

new formal.ResourceOauthSettings("mcpOAuth", {
  resourceId: resource.id,
});

Create a Resource with the MCP endpoint and its Space ID.

export FORMAL_API_KEY="<YOUR_API_KEY>"
RESOURCE_RESPONSE=$(curl --fail --silent --show-error \
  --request POST \
  https://api.formal.ai/core.v1.ResourceService/CreateResource \
  --header "x-api-key: ${FORMAL_API_KEY}" \
  --header "Content-Type: application/json" \
  --data-binary @- <<JSON
  {
    "name": "internal-tools",
    "hostname": "mcp.internal.example.com",
    "port": 443,
    "technology": "mcp",
    "spaceId": "<SPACE_ID>",
    "tags": [
      {
        "key": "mcp-endpoint",
        "value": "/mcp"
      }
    ]
  }
JSON
)
RESOURCE_ID=$(printf '%s' "${RESOURCE_RESPONSE}" | jq -r '.resource.id')
curl --fail --silent --show-error \
  --request POST \
  https://api.formal.ai/core.v1.ResourceService/CreateResourceOAuthSettings \
  --header "x-api-key: ${FORMAL_API_KEY}" \
  --header "Content-Type: application/json" \
  --data-binary @- <<JSON
  {
    "resourceId": "${RESOURCE_ID}"
  }
JSON

2. Setup Authentication

Choose which credential Formal sends to the server. See Upstream authentication for details.

Linked Accounts
Shared Credentials
Pass Through

Each user links their own OAuth account once. Formal stores the token encrypted and refreshes it when the server supports refresh. The Connector adds the token to requests after policies allow them. Users never see the token.Formal’s app uses an app registered with the provider, when available. Otherwise, it can use a Client ID Metadata Document (CIMD) when supported. For CIMD, the server’s authorization server must advertise client_id_metadata_document_supported: true. It must support authorization code with PKCE S256 and public clients with token endpoint authentication none.Formal checks the server when you save. If neither option works, register your own OAuth app with the provider. Add the Catalog’s Redirect URI to its allowed redirects. Then enter the app’s Client ID and optional Client secret.

3. Route Endpoint traffic

Auth is managed at the Connector with Linked Accounts or Shared Credentials. The Endpoint forwards MCP traffic to it. Laptops and VMs with the Formal Endpoint keep using https://mcp.internal.example.com/mcp. A network rule sends that traffic to the Connector.

UI
Terraform
Pulumi
API

Go to Network Rules and create a rule named internal-tools-mcp.
Paste this expression, set the rule to Active, then save:

{
  "condition": {
    "pre_tcp": process.is_agent,
    // Every MCP server added to Formal: process.is_agent && resource.technology == "mcp"
    "pre_tls": process.is_agent && hostname == "mcp.internal.example.com",
    "post_tls": true
  },
  "outputs": {
    "forward_to_connector": true
  }
}

resource "formal_network_rule" "internal_tools_mcp" {
  name        = "internal-tools-mcp"
  description = "Forward custom MCP traffic from agents to the Connector"
  status      = "active"

  # Every MCP server added to Formal: set pre_tls to process.is_agent && resource.technology == "mcp"
  cel_expression = <<-EOT
    {
      "condition": {
        "pre_tcp": process.is_agent,
        "pre_tls": process.is_agent && hostname == "mcp.internal.example.com",
        "post_tls": true
      },
      "outputs": {
        "forward_to_connector": true
      }
    }
  EOT
}

import * as formal from "@formalco/pulumi";

new formal.NetworkRule("internalToolsMcp", {
  name: "internal-tools-mcp",
  description: "Forward custom MCP traffic from agents to the Connector",
  status: "active",
  // Every MCP server added to Formal: set pre_tls to process.is_agent && resource.technology == "mcp"
  celExpression: `
    {
      "condition": {
        "pre_tcp": process.is_agent,
        "pre_tls": process.is_agent && hostname == "mcp.internal.example.com",
        "post_tls": true
      },
      "outputs": {
        "forward_to_connector": true
      }
    }
  `,
});

export FORMAL_API_KEY="<YOUR_API_KEY>"
# Every MCP server added to Formal: set pre_tls to process.is_agent && resource.technology == "mcp"
CEL_EXPRESSION=$(cat <<'CEL'
{
  "condition": {
    "pre_tcp": process.is_agent,
    "pre_tls": process.is_agent && hostname == "mcp.internal.example.com",
    "post_tls": true
  },
  "outputs": {
    "forward_to_connector": true
  }
}
CEL
)
jq -n --arg cel "${CEL_EXPRESSION}" '{
  name: "internal-tools-mcp",
  description: "Forward custom MCP traffic from agents to the Connector",
  status: "active",
  celExpression: $cel
}' | curl --fail --silent --show-error \
  --request POST \
  https://api.formal.ai/core.v1.DesktopService/CreateDesktopRoutingRule \
  --header "x-api-key: ${FORMAL_API_KEY}" \
  --header "Content-Type: application/json" \
  --data-binary @-

The rule matches known agents only. See Identity headers.Cloud agents such as Claude, ChatGPT, and Cursor Cloud Agents don’t run the Endpoint. Point them at this server’s Connector address, https://internal-tools.<connector-hostname>/mcp. Find it in the Admin Catalog: open Internal Tools, then copy Connector address on Configuration.

4. Create policies

Use the tool names your MCP server exposes when you write policies.

Policies examples

Block a tool
Mask a tool's output

This policy blocks tools that change data, so agents can only read Internal Tools.

package formal.v2

import future.keywords.if
import future.keywords.in

write_tools := {
  "delete_record",
  "update_record",
}

request := {
  "action": "block",
  "type": "block_with_custom_message",
  "message": "Writing to Internal Tools is not allowed.",
} if {
  input.resource.name == "internal-tools"
  input.mcp.method == "tools/call"
  input.mcp.tool_name in write_tools
}

This policy masks emails and phone numbers in search_records results.

package formal.v2

import future.keywords.if

email_pattern := `[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}`
phone_pattern := `\+?[0-9][0-9().\s-]{7,}[0-9]`

response := {
  "action": "rewrite",
  "body": regex.replace(regex.replace(input.http.body, email_pattern, "[REDACTED-EMAIL]"), phone_pattern, "[REDACTED-PHONE]"),
  "reason": "Mask emails and phone numbers in search results",
} if {
  input.resource.name == "internal-tools"
  input.mcp.tool_name == "search_records"
  regex.match(email_pattern, input.http.body) or regex.match(phone_pattern, input.http.body)
}

See MCP resources for input.mcp fields and Rewrite Action for body rewrites.

5. Check the logs

Open Logs and search for resource.name:internal-tools. Each tool call is one request log with the user, MCP client, and tool. Open a log to see its tool parameters and the policies it triggered. A blocked write shows the block policy and its message. A masked search shows the rewrite policy.See Logs for search syntax and filters.

Troubleshooting

The server rejected your credentials

The agent says the server rejected your credentials. Link or re-link your account in Formal.Cause: The server no longer accepts the linked token, for example after access was revoked.Fix: Link your account again from the Employee Catalog.With Shared Credentials, replace the credential on the server’s Shared Credentials configuration.

Laptop traffic doesn't appear in Logs

Cause: The Endpoint isn’t running, or the network rule doesn’t match the client.Fix: Check that the Endpoint is connected. The rule only matches known agents. Other clients reach mcp.internal.example.com directly unless the rule also matches them. See Network rules.

MCP clients can't connect directly yet

Cause: The Configuration tab lists the reason, often No Connector is in this server's Space.Fix: Edit the server and choose the Space containing your Connector.

The server has no Connector address

Cause: The server name isn’t a valid DNS label.Fix: Recreate the server with a valid DNS-label name.

Getting Started

Example Use Cases

AI Governance

Configuring Formal

Integrations

Configuration

0. Prepare your Connector

1. Add your custom MCP server to your Resources

2. Setup Authentication

3. Route Endpoint traffic

4. Create policies

Policies examples

5. Check the logs

Troubleshooting

Next Steps

MCP Gateway

All MCP servers

​0. Prepare your Connector

​1. Add your custom MCP server to your Resources

​2. Setup Authentication

​3. Route Endpoint traffic

​4. Create policies

​Policies examples

​5. Check the logs

​Troubleshooting

​Next Steps

MCP Gateway

All MCP servers

0. Prepare your Connector

1. Add your custom MCP server to your Resources

2. Setup Authentication

3. Route Endpoint traffic

4. Create policies

Policies examples

5. Check the logs

Troubleshooting

Next Steps