server_url points to your deployed MCP endpoint.
Custom MCP
Build a custom Grok MCP connector from OpenAPI.
Custom Grok connectors should start from the API contract, not a hand-maintained list of endpoints. Sourced converts OpenAPI into a remote MCP pack and blocks risky defaults before setup.
01Outputs
The generated connector shape
server_label is derived from the API name and safe for reuse across snippets.
allowed_tools includes only non-sensitive read tools by default.
authorization and headers are documented for hosted MCP protection when needed.
02Details
Auth and hosting
No hosted URL means no Grok remote connector yet; Sourced gives you the expected config after hosting.
OAuth/OpenID Connect specs are blocked until callback URLs, storage, refresh, and consent are reviewed.
Authenticated APIs over non-local HTTP are blocked until the base URL moves to HTTPS.
The generated MCP server reads API credentials from environment variables, not from chat-visible tool inputs.
03Details
Review before expose
Read-only public-list operations can be enabled first.
Sensitive read operations, like API keys or account users, stay out of the default allowlist.
Write and destructive operations require an owner-approved allowlist change.
The same pack includes tests proving destructive tools are not default-enabled.
04Details
Customer-owned repo path
Sourced keeps GitHub writes out of the Grok path for launch; commit the downloaded pack to an owner-approved repo before deployment.
The generated PR plan is local to your repo and never targets xAI-owned repositories.
Draft PR creation should remain explicit and owner-approved.
The pack includes a review body so a maintainer sees files, risks, and tests before merging.