Skip to main content
Composite MCP is a single authenticated MCP endpoint that exposes tools from the connectors each tenant has linked in Hotglue. Instead of wiring every third-party MCP into your AI client separately, you connect once and get a unified, tenant-scoped tool surface. The live endpoint is:
Composite MCP handles three things for you:
  1. Authentication — validates a per-tenant bearer token issued by Hotglue
  2. Tool discovery — surfaces available tools from linked connectors that have an MCP backend
  3. Routing — proxies tool calls to the underlying MCP (an official provider like Notion or Atlassian, or a custom MCP built by Hotglue)

​
Why a composite MCP?

MCP clients typically need a separate server configuration per provider — each with its own auth flow, token refresh, and tool namespace. That breaks down when you ship integrations to many customers:
  • Each tenant links different connectors
  • Credentials live in Hotglue, not in the AI client
  • You want one MCP URL in Cursor, Claude, or any MCP-compatible agent
A composite MCP server sits in front of those upstream MCPs. With one connection and one bearer token, your agent sees every tool the tenant is allowed to use — namespaced by connector (for example notion.search, jira.createJiraIssue). That means you keep using Hotglue’s existing connection UX, while AI agents get a single, secure gateway into customer systems.

​
Demo

​
Compatible with existing auth

Composite MCP is fully compatible with Hotglue’s existing authentication components. Tenants can link connectors the same way they already do today:
  • Embedded widget — users connect integrations in your app
  • Magic Links — share a branded URL for connection setup without embedding the widget
Once a tenant has linked a supported connector, Composite MCP can discover that link and route tool calls using the credentials stored in Hotglue. You do not need a separate OAuth flow inside the MCP client.

​
How it works

  1. Your backend requests a per-tenant MCP token from the Hotglue API
  2. Your MCP client connects to https://mcp.hotglue.com/mcp with that token as a Bearer credential
  3. Composite MCP looks up the tenant’s linked connectors and exposes tools from any that have a registered MCP backend
  4. Tool calls are authenticated and forwarded to the upstream MCP, then returned to the client

​
Get a per-tenant MCP token

Authentication is per tenant. Call the /mcpToken endpoint with your API key to generate a bearer token for a specific environment, flow, and tenant:
Example response:
Use the returned token value as the Bearer token when calling Composite MCP. Issue a token for each tenant whose connectors the agent should access — the token scopes discovery and tool calls to that tenant’s linked credentials.
The MCP token encodes the environment, flow, tenant, public API key, and a JWT used to call the Hotglue API on the tenant’s behalf. Treat it like a secret and store it securely on your backend.

​
Connect an MCP client

Point any Streamable HTTP–compatible MCP client at the Composite MCP URL and pass the tenant token in the Authorization header. Example configuration:
Replace <mcp-token> with the token returned by /mcpToken for the tenant.

​
Upstream MCP backends

Composite MCP routes to upstream MCP servers based on the connectors linked for the tenant. That can include:
  • Official provider MCPs — for example Notion (https://mcp.notion.com/mcp) or Atlassian / Jira
  • Custom MCPs built by Hotglue — for connectors where Hotglue maintains the MCP surface
Only linked connectors with a known MCP backend are exposed. Tools are namespaced as {connector}.{tool_name} so agents can tell providers apart when multiple connectors are linked.

​
Quick start checklist

  1. Let the tenant link connectors via the widget or a Magic Link
  2. Generate an MCP token with GET /{env_id}/{flow_id}/{tenant}/mcpToken
  3. Configure your MCP client with https://mcp.hotglue.com/mcp and Authorization: Bearer <token>
  4. List tools — you should see namespaced tools for each supported linked connector
  5. Call tools as usual; Composite MCP authenticates and proxies to the upstream MCP