> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hotglue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Composite MCP

> One authenticated MCP endpoint for every connector your tenants link through Hotglue

**Composite MCP** is a single authenticated MCP endpoint that exposes tools from the connectors each tenant has linked in Hotglue. Instead of wiring every third-party MCP into your AI client separately, you connect once and get a unified, tenant-scoped tool surface.

The live endpoint is:

```
https://mcp.hotglue.com/mcp
```

Composite MCP handles three things for you:

1. **Authentication** — validates a per-tenant bearer token issued by Hotglue
2. **Tool discovery** — surfaces available tools from linked connectors that have an MCP backend
3. **Routing** — proxies tool calls to the underlying MCP (an official provider like Notion or Atlassian, or a custom MCP built by Hotglue)

# Why a composite MCP?

MCP clients typically need a separate server configuration per provider — each with its own auth flow, token refresh, and tool namespace. That breaks down when you ship integrations to many customers:

* Each tenant links different connectors
* Credentials live in Hotglue, not in the AI client
* You want one MCP URL in Cursor, Claude, or any MCP-compatible agent

A **composite MCP server** sits in front of those upstream MCPs. With one connection and one bearer token, your agent sees every tool the tenant is allowed to use — namespaced by connector (for example `notion.search`, `jira.createJiraIssue`).

That means you keep using Hotglue's existing connection UX, while AI agents get a single, secure gateway into customer systems.

# Demo

<iframe width="100%" height="480" src="https://www.loom.com/embed/7d4e215368b1494d8b8d2a6192aa9739" title="Composite MCP Feature Demo" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen className="w-full aspect-video" />

# Compatible with existing auth

Composite MCP is fully compatible with Hotglue's existing authentication components. Tenants can link connectors the same way they already do today:

* **[Embedded widget](/widget-v3/overview)** — users connect integrations in your app
* **[Magic Links](/connection-methods/magic-links)** — share a branded URL for connection setup without embedding the widget

Once a tenant has linked a supported connector, Composite MCP can discover that link and route tool calls using the credentials stored in Hotglue. You do not need a separate OAuth flow inside the MCP client.

# How it works

```mermaid theme={null}
sequenceDiagram
    participant Client as MCP Client
    participant Composite as Composite MCP
    participant Hotglue as Hotglue API
    participant Upstream as Upstream MCP

    Client->>Composite: POST /mcp (Bearer mcpToken)
    Composite->>Hotglue: Resolve linked connectors
    Hotglue-->>Composite: Linked connectors for tenant
    Composite->>Hotglue: Resolve connector access tokens
    Hotglue-->>Composite: Access tokens
    Composite->>Upstream: tools/list
    Upstream-->>Composite: Provider tools
    Composite-->>Client: Namespaced tools (e.g. notion.*)

    Client->>Composite: tools/call notion.search
    Composite->>Upstream: tools/call search
    Upstream-->>Composite: Result
    Composite-->>Client: Proxied result
```

1. Your backend requests a per-tenant MCP token from the Hotglue API
2. Your MCP client connects to `https://mcp.hotglue.com/mcp` with that token as a Bearer credential
3. Composite MCP looks up the tenant's linked connectors and exposes tools from any that have a registered MCP backend
4. Tool calls are authenticated and forwarded to the upstream MCP, then returned to the client

# Get a per-tenant MCP token

Authentication is **per tenant**. Call the [`/mcpToken`](/api-reference/mcp/generate-mcp-token) endpoint with your API key to generate a bearer token for a specific environment, flow, and tenant:

```bash theme={null}
curl --request GET \
  --url 'https://api.hotglue.com/{env_id}/{flow_id}/{tenant}/mcpToken' \
  --header 'x-api-key: <api-key>'
```

Example response:

```json theme={null}
{
  "token": "<base64-encoded-mcp-token>"
}
```

Use the returned `token` value as the Bearer token when calling Composite MCP. Issue a token for each tenant whose connectors the agent should access — the token scopes discovery and tool calls to that tenant's linked credentials.

<Info>
  The MCP token encodes the environment, flow, tenant, public API key, and a JWT used to call the Hotglue API on the tenant's behalf. Treat it like a secret and store it securely on your backend.
</Info>

# Connect an MCP client

Point any Streamable HTTP–compatible MCP client at the Composite MCP URL and pass the tenant token in the `Authorization` header.

Example configuration:

```json theme={null}
{
  "mcpServers": {
    "hotglue": {
      "url": "https://mcp.hotglue.com/mcp",
      "headers": {
        "Authorization": "Bearer <mcp-token>"
      }
    }
  }
}
```

Replace `<mcp-token>` with the `token` returned by `/mcpToken` for the tenant.

# Upstream MCP backends

Composite MCP routes to upstream MCP servers based on the connectors linked for the tenant. That can include:

* **Official provider MCPs** — for example Notion (`https://mcp.notion.com/mcp`) or Atlassian / Jira
* **Custom MCPs built by Hotglue** — for connectors where Hotglue maintains the MCP surface

Only linked connectors with a known MCP backend are exposed. Tools are namespaced as `{connector}.{tool_name}` so agents can tell providers apart when multiple connectors are linked.

# Quick start checklist

1. Let the tenant link connectors via the [widget](/widget-v3/overview) or a [Magic Link](/connection-methods/magic-links)
2. Generate an MCP token with [`GET /{env_id}/{flow_id}/{tenant}/mcpToken`](/api-reference/mcp/generate-mcp-token)
3. Configure your MCP client with `https://mcp.hotglue.com/mcp` and `Authorization: Bearer <token>`
4. List tools — you should see namespaced tools for each supported linked connector
5. Call tools as usual; Composite MCP authenticates and proxies to the upstream MCP