Beyond the built-in spokes, you can attach any MCP server to an agent. The agent will see those tools alongside its spoke tools.
Add an MCP
See Add an MCP server for the full flow. Short version:
1
Settings → MCP tab → Add MCP server. Pick stdio or HTTP.
2
Enter the connection details (command + args for stdio; URL + auth header for HTTP).
3
Test connection — Ambrose introspects the server's tool list.
4
Save → the MCP is now mountable.
5
On the agent's detail page → Attached MCPs → toggle this MCP on.
Per-tool permissions
Inside the attached MCP, you can allow individual tools and deny others. Permissions.
HIPAA
External MCPs by default go through the PHI Rail. Mark a destination as BAA-allowlisted only if you have a signed BAA with the vendor.