# cs remote (/docs/cli/remote)

`cs remote` registers any HTTPS MCP server as a **remote connector** whose
tools appear as `org__<slug>__<tool>` on `/mcp`. Writes need an organization
admin and otherwise answer `admin_required`. The registration model, callback
URL, and failure states are on [Remote MCP servers](/docs/connectors/remote-mcp).

## Usage \[#usage]

```bash
cs remote add <slug> --url <https://…> --auth oauth|static_bearer|none \
  [--name "Display Name"] [--client-id <id>] [--header <name>]… [--yes]
cs remote list
cs remote show <slug>
cs remote refresh <slug>
cs remote remove <slug>
```

## add \[#add]

`cs remote add` registers the server, pulls its `tools/list` snapshot, and
prints how the tools will appear. Secrets — a bearer token, a client secret,
header values — are prompted on `stdin`, never passed on the command line;
a piped first line is accepted for automation.

```bash
echo "$UPSTREAM_TOKEN" | cs remote add acme \
  --url https://mcp.acme.internal/mcp --auth static_bearer
```

### --url \[#--url]

The server's MCP endpoint. It may carry a configuration query string such as
`?readonly=true`, but no credentials.

### --auth \[#--auth]

* `oauth` — each member authorizes their own account. CoreSpeed registers an
  OAuth client automatically where the server's authorization server offers
  dynamic client registration; where it does not, pre-register one there and
  pass `--client-id`.
* `static_bearer` — one organization-wide token, prompted on `stdin` and
  encrypted at rest.
* `none` — no credential. The command warns that anyone who knows the URL can
  call the server and asks for confirmation.

### --name \[#--name]

A display name for the dashboard and `cs remote list`; defaults to the slug.

### --client-id \[#--client-id]

For `--auth oauth` against a server without dynamic registration: the client
id you pre-registered. Its secret is prompted next; leave it empty for a
public, PKCE-only client.

### --header \[#--header]

The name of a custom header to send upstream; its value is prompted. Repeat the
flag for several headers.

### --yes \[#--yes]

Skips the `--auth none` confirmation. Without it, a non-interactive run refuses
to register an unauthenticated server.

## list \[#list]

`cs remote list` prints the organization's remote connectors with status, auth
mode, snapshot size, and upstream URL. A registration stuck in `dcr_pending`
carries its recovery instructions.

## show \[#show]

`cs remote show <slug>` prints one registration in full: URL, auth mode, OAuth
client, status, the authorize link for members, snapshot size and time, and
who registered it.

## refresh \[#refresh]

`cs remote refresh <slug>` re-pulls the server's `tools/list` and reports
whether the tool surface changed. One refresh per connector per 60 seconds;
sooner answers `429`.

## remove \[#remove]

`cs remote remove <slug>` deletes the registration, its snapshots, and its
credential. A `dcr_pending` reservation is cleared the same way; the CLI
supplies the precondition itself.