MCP Client: Connect a Self-Hosted AI Agent to MCP Servers

2026-11-11

An MCP client is the part of an AI application that connects to Model Context Protocol (MCP) servers, lists the tools they offer and calls them for the model. POLYROB, the open-source (MIT) self-hosted AI agent, has one built in: you turn it on with one setting, add a server from any chat, and the agent can use that server’s tools from the next turn.

What is an MCP client?

In the Model Context Protocol, a server exposes tools, resources and prompts. A client sits inside the host application, opens a connection to each server and asks it what it has. The model then picks a tool, the client sends the call and the result goes back into the conversation.

So when you search for an MCP client you are usually looking for one of two things: a host such as an IDE or a desktop assistant that can connect to servers, or an agent that can use servers without you writing glue code. POLYROB is the second kind. It is an agent you run yourself, and the MCP client is one of its tools.

How does the POLYROB MCP client work?

One tool, called mcp, gives the agent access to every configured server. Each tool a server offers also shows up to the model as a direct action named {server}_{tool}. The tool is not in the default tool list, so a session has to ask for it. No server is configured out of the box (tools/mcp/[email protected]).

Four transports are supported: stdio, sse, http and streamable_http (tools/mcp/[email protected], tools/mcp/[email protected]). The package that does the work in tools/mcp/ covers server connections, tool discovery, circuit breakers, JSON-schema argument coercion and resource-update subscriptions.

Besides calling tools, the agent can list servers, check a server’s status, connect, disconnect or reload one, read resources and run a health check. These are all actions on the same mcp tool (tools/mcp/[email protected]).

How do I turn it on and add a server?

Turn the tool on once:

polyrob config set MCP_ENABLED true

It becomes usable as soon as one server exists (docs/guide/[email protected], section “MCP”). There are two ways to add one.

From chat. Send /mcp in any chat surface or in the terminal:

/mcp                                 # each server: transport, tool count, last probe, last error
/mcp add aave https://mcp.aave.com   # add one (an api key may follow the URL)
/mcp remove <id>                     # drop it; the agent loses it from the next turn
/mcp test <id>                       # connect now and count the tools

The server is saved against your tenant and the agent can use it from the next turn, with no restart and no deploy. /mcp add finds the transport itself: it tries Streamable HTTP, then plain HTTP, then SSE, and saves the first one that answers. A refusal names the HTTP status and the server’s first line, for example HTTP 401: missing api key (docs/guide/[email protected]).

From a file. Operator servers live in ~/.polyrob/mcp.json, with secrets written as ${VAR} placeholders. config/mcp_config.json in the code tree holds the shipped defaults only, and a deploy or an update replaces it, so keep your own servers in ~/.polyrob/mcp.json (docs/guide/[email protected]). A project-local .polyrob/mcp.json is never loaded.

What can an added server reach?

This is the part to read before you add anything.

Its output is data, not orders. Everything an MCP tool returns is framed as untrusted data, in the same class as browser pages and fetched web content, because it may carry adversarial text (docs/guide/[email protected]).
It cannot touch the wallet. No MCP tool can reach the signer, and no money verb accepts calldata from outside the process. A server that prepares unsigned transactions gives the agent something to read, and no ability to spend (docs/guide/[email protected]).
From chat, HTTPS only. A URL added with /mcp add must be HTTPS and passes an SSRF check, with the resolved address pinned. A local command such as npx ... is refused, because saving one would save arbitrary code execution on your machine (docs/guide/[email protected], tools/mcp/[email protected]).
Local stdio servers are an operator decision. If you need one, you add it to the config file on the box. The child process gets an environment built from a fixed allowlist, so provider keys and wallet seeds are left out. The server is still a full sibling process with your own OS privileges and no sandbox, so treat the binary as fully trusted code (docs/guide/[email protected]).
Servers that hold money keys can be marked. If a server holds its own exchange key or external wallet, mark it with "money": true in ~/.polyrob/mcp.json. Each of its actions then waits for your approval in /inbox, and the generic mcp_execute_tool refuses it (docs/guide/[email protected]).

Credentials for servers you add are stored encrypted. In production the encryption layer needs a real MCP_ENCRYPTION_KEY instead of the dev key file (docs/[email protected]).

Can I manage MCP servers over an API?

Yes. For a deployment that serves several users, the REST API has ten routes under /api/mcp/* to add, list, update, remove and test servers per tenant, list the available tools, change settings and read an audit of what was called and by whom (docs/guide/[email protected]).

Is POLYROB also an MCP server?

It can be, as a separate feature that is off by default. Setting MCP_SERVE_ENABLED=true mounts POST /mcp, so a client such as Claude Desktop or Cursor can connect to POLYROB. It exposes five read-only, tenant-scoped tools: usage summary, goals list, goal show, conversations and pending approvals. It is JSON-RPC over POST only, with no SSE or streamable transport and no writes (docs/[email protected], docs/guide/[email protected]). The two sides are independent: MCP_ENABLED is the agent reaching out, MCP_SERVE_ENABLED is others reaching in.

Where does the POLYROB MCP client fall short?

OAuth for MCP servers exists as an opt-in flag, MCP_OAUTH_ENABLED, off by default. No shipped server declares an auth block, so today it is groundwork and not something to rely on (docs/[email protected]). Use an API key or an HTTP header with a ${VAR} secret instead.
No server comes with the install. You bring the ones you want.
A local stdio server cannot be added from chat. That is deliberate, and it means a file edit on the box.
The inbound MCP server is read-only and small.
POLYROB is a young project. There are no benchmarks for MCP call speed or reliability, so none are claimed here.

FAQ

Do I need to restart POLYROB after adding an MCP server?

No. A server added with /mcp add is saved against your tenant and available from the next turn. Removing one has the same timing.

Which transports does the POLYROB MCP client support?

Stdio, SSE, plain HTTP and Streamable HTTP. When you add a server from chat, POLYROB tries Streamable HTTP first, then HTTP, then SSE.

Can the agent use an MCP server to spend money?

Not through POLYROB’s wallet. No MCP tool can reach the signer. A server that holds its own money credential can be marked in the config file, and then every call waits for your approval.

Is an MCP server’s output treated as instructions?

No. Tool output is framed as untrusted data, like web pages and email bodies.

Can Claude Desktop or Cursor use POLYROB as an MCP server?

Yes, once you set MCP_SERVE_ENABLED to true. It offers five read-only tools at POST /mcp. See the Claude AI agent guide for using Claude models with POLYROB.

Next steps

POLYROB is a self-hosted agent: see what self-hosting involves, how skills work next to tools and the open-source overview. The install page has the one-line installer and the docs cover every setting above. The MCP specification and client concepts are on the Model Context Protocol site, and the code is in the public repository.

Sources, all in https://github.com/theselfruleorg/polyrob at tag v1.7.7: tools/mcp/README.md, tools/mcp/config.py, tools/mcp/mcp_tool.py, tools/mcp/user_mcp_service.py, docs/guide/configuration.md, docs/guide/owner-controls.md, docs/guide/security-model.md, docs/guide/api.md, docs/CONFIGURATION.md.

POLYROB is an open-source AI agent you run and own. Install it or read the docs.