> ## Documentation Index > Fetch the complete documentation index at: https://docs.getsesame.dev/llms.txt > Use this file to discover all available pages before exploring further. # MCP Server Integration: Zero-Trust Tool Access via Sesame > Connect any MCP server through Sesame so your agent gets the tools without the tokens. Supports Linear, Atlassian, Sentry, and custom MCP servers. Connect any MCP server by storing its credential in Sesame as a secret scoped to the server's hostname. Your agent reaches the server through the broker, which injects the credential server-side — the token never enters the agent's environment. The same flow covers your own **custom MCP servers** and hosted ones such as Linear. Connect any MCP server by providing its hostname and secrets Create, update, and query Linear issues and projects. ## Connect a custom MCP server In the dashboard's left navigation, go to **Secrets**, then click **Add Secret**. In the **Hostname** field, open the **Select a service or enter URL…** dropdown and choose **Enter custom URL**. Type your server's host — for example, `mcp.example.com`. Give the secret a **Label** so it's recognizable in the list (for example, `acme_mcp`). Under **Secret value source**, select **Paste value** and paste the MCP server's token. (Use **OAuth 2.0** if the server issues OAuth tokens, or **Reference my AWS** to point at an existing AWS Secrets Manager ARN instead of pasting.) Pick the **Injection Mode** that matches how the server authenticates: * **Bearer token** — sent as `Authorization: Bearer ` (the default; most MCP servers). * **Custom header** — choose this and fill **Header Name** (e.g. `X-Api-Key`) for servers using a non-standard header. Click **Next: Access Policy** — optionally restrict methods or paths — then **Save**. The server now appears in your secrets list with a **Use with your agent** action. ## Hosted MCP servers A hosted server like Linear uses the exact same steps — enter its hostname in step 2 instead of a custom URL. Well-known services may already appear in the **Select a service…** dropdown, so you can pick one rather than typing the URL; otherwise enter it the same way as a custom server. ## Call it from your agent Every authenticated request to the MCP server goes through `sesame request`; the broker matches the hostname to the secret and injects the credential. Your code never adds the auth header. ```bash theme={null} sesame request POST https://mcp.example.com/ -d '' The first call to a hostname you haven't used before blocks while you approve access, then completes. Treat the wait as expected, not an error. ```