Tools and MCP

There are two ways to give an agent MCP servers: add them on the console’s Connectors page, or put them in the repo’s own .mcp.json. Connectors keep the token out of the sandbox, so use them for anything that needs a credential.

• Connectors are set up once for the project, on its Connectors page in the console. The token stays outside the sandbox, and the server needs no egress rule. Live sessions on the Highflame gateway (not --direct) started after you add one get it. Prompt runs don’t get connectors yet.
• The repo’s .mcp.json is a file in the repo. Any token in it is in the sandbox. Live sessions and prompt runs start its servers only with --trust-repo-mcp, and under baseline-secure and pci-scope each server’s host needs an egress rule.

Connectors

A connector is an MCP server that the whole project shares, with one token. The Highflame gateway adds the token to each call, so agents use the server without seeing the token. Anyone in the project can add, change or remove connectors.

1. Open your project in the console and click Connectors in the sidebar.

2. Under Add a connector, fill in:

   • Name: lowercase letters, numbers and dashes. Agents see the server under this name.
   • URL: the server’s address. It must start with https://.
   • Shared token: for example a bot account’s API key. A bare token is sent as Bearer <token>. A value that names its own scheme, such as token <value>, is sent as it is.

3. To turn on the server’s read-only tools now, check Turn on its read-only tools. Write tools stay off.

4. Click Test and add. The console tries the token against the server first, and doesn’t save a server that refuses it. The token is never shown again.

5. Under Servers, pick which tools agents may call, and click Save tools. Agents get no tools from a server until you turn some on. Only read-only tools picks the tools the server marks read-only.

The next live session in the project gets the server under its name, with only the tools you turned on. Its calls go through the Highflame gateway, which adds the shared token, so the server needs no egress rule. A --direct launch skips the gateway and gets no connectors. Prompt runs don’t get connectors yet.

To change a connector, use the buttons on its card:

• Change: a new URL or token. A new URL needs the token again.
• Turn off and Turn on: keep the connector but stop giving it to sandboxes, or start again.
• Remove: delete it.

Sandboxes started after a change get it.

A server with a Studio tag is one where each person connects their own account. You set it up and change it in Highflame Studio, not here. Droneship sandboxes don’t get these servers yet.

GitHub issues and pull requests

On the Connectors page, click Use GitHub. It fills in GitHub’s MCP server (https://api.githubcopilot.com/mcp/) under the name github.

1. Create a fine-grained token on GitHub. Give it only the repos agents need, with Issues and Pull requests set to Read and write (or Read-only), and Contents and Metadata set to Read.
2. Paste the token and click Test and add.

The console turns on the server’s read-only tools once GitHub has listed them. If any are still off, turn them on in the server’s tool list. Write tools, such as create_pull_request, stay off until you turn them on there.

The token is shared by the project: every agent in it acts as the token’s owner on GitHub.

The repo’s .mcp.json

To give the agent the MCP servers in your repo’s .mcp.json, launch with --trust-repo-mcp. Without it, the sandbox doesn’t start them.

Every sandbox clones your repo at your current branch, so it reads the .mcp.json you committed and pushed. A local change that you did not push is not in the sandbox.

{
  "mcpServers": {
    "docs": {
      "type": "http",
      "url": "https://mcp.example.com/mcp"
    }
  }
}

.mcp.json is Claude Code’s file, so this applies to the claude agent.

Off by default

A .mcp.json server can run any command, and it is the repo author’s code. So a launch on a repo with a .mcp.json leaves its servers off and says so:

Repo MCP servers not started; add --trust-repo-mcp to start them.

This holds for interactive sessions and prompt runs alike.

Start them

droneship run claude --trust-repo-mcp
droneship run claude -p "<task>" -d --trust-repo-mcp

A prompt run with --trust-repo-mcp starts every server the file names, including servers that run a command, and nobody is there to review them.

Caution

Pass --trust-repo-mcp only on repos and branches you trust. Never pass it for a fork’s pull request or a third-party repo: its .mcp.json can run any command in the sandbox.

Network access

Each .mcp.json server’s host must be allowed by the sandbox’s egress policy, or the server fails to connect.

• baseline-secure (the default) reaches a server only if its host is on the bundle’s list.
• pci-scope allows only the hosts the launch needs.
• open-dev reaches any host.

Under baseline-secure and pci-scope, add an allow rule for the server’s host to the project’s egress rules. Only HTTPS servers on port 443 can be allowed by host name.

Keys and tokens

Danger

Never put keys or tokens in .mcp.json. The file goes into the sandbox, and a committed one goes into every sandbox on the repo.

A key that you paste into the sandbox stays in the sandbox. To give a server a token without putting it in the sandbox, add the server as a connector instead.

Servers you add by hand

claude mcp add inside a sandbox works for that sandbox only. The next sandbox, and every prompt run, does not have the server. MCP servers in your Claude Code settings outside the repo, such as ~/.claude.json, are not copied into the sandbox.

More: Console, Harnesses and models, Background runs and logs.

Next

• Egress: which hosts the sandbox can reach.
• Isolation and identity: the credential each sandbox uses.
• Activity: see what the agent did.