cs remote

cs remote registers any HTTPS MCP server as a remote connector whose tools appear as org__<slug>__<tool> on /mcp. Writes need an organization admin and otherwise answer admin_required. The registration model, callback URL, and failure states are on Remote MCP servers.

Usage

cs remote add <slug> --url <https://…> --auth oauth|static_bearer|none \
  [--name "Display Name"] [--client-id <id>] [--header <name>]… [--yes]
cs remote list
cs remote show <slug>
cs remote refresh <slug>
cs remote remove <slug>

add

cs remote add registers the server, pulls its tools/list snapshot, and prints how the tools will appear. Secrets — a bearer token, a client secret, header values — are prompted on stdin, never passed on the command line; a piped first line is accepted for automation.

echo "$UPSTREAM_TOKEN" | cs remote add acme \
  --url https://mcp.acme.internal/mcp --auth static_bearer

--url

The server's MCP endpoint. It may carry a configuration query string such as ?readonly=true, but no credentials.

--auth

• oauth — each member authorizes their own account. CoreSpeed registers an OAuth client automatically where the server's authorization server offers dynamic client registration; where it does not, pre-register one there and pass --client-id.
• static_bearer — one organization-wide token, prompted on stdin and encrypted at rest.
• none — no credential. The command warns that anyone who knows the URL can call the server and asks for confirmation.

--name

A display name for the dashboard and cs remote list; defaults to the slug.

--client-id

For --auth oauth against a server without dynamic registration: the client id you pre-registered. Its secret is prompted next; leave it empty for a public, PKCE-only client.

--header

The name of a custom header to send upstream; its value is prompted. Repeat the flag for several headers.

--yes

Skips the --auth none confirmation. Without it, a non-interactive run refuses to register an unauthenticated server.

list

cs remote list prints the organization's remote connectors with status, auth mode, snapshot size, and upstream URL. A registration stuck in dcr_pending carries its recovery instructions.

show

cs remote show <slug> prints one registration in full: URL, auth mode, OAuth client, status, the authorize link for members, snapshot size and time, and who registered it.

refresh

cs remote refresh <slug> re-pulls the server's tools/list and reports whether the tool surface changed. One refresh per connector per 60 seconds; sooner answers 429.

remove

cs remote remove <slug> deletes the registration, its snapshots, and its credential. A dcr_pending reservation is cleared the same way; the CLI supplies the precondition itself.