How to Configure External MCP Servers in CyberStrikeAI UI

To configure external MCP servers in CyberStrikeAI, navigate to MCP Management, click "Add external MCP," paste a JSON configuration object defining the transport method (stdio, http, or sse), and click Save to register the server via the REST API.

The CyberStrikeAI repository provides a complete web-based interface for managing Modular Command Processor (MCP) backends without modifying source code. This guide covers the exact steps, JSON schema requirements, and underlying API implementation based on the current codebase in Ed1s0nZ/CyberStrikeAI.

Understanding External MCP Configuration in CyberStrikeAI

CyberStrikeAI supports external MCP servers that run outside the main application process. The UI implementation spans three critical files: web/templates/index.html handles the layout and modal dialogs, web/static/js/settings.js contains the management logic in functions like loadExternalMCPs() and saveExternalMCP(), and web/static/js/chat.js integrates external tools into the chat interface around line 9 where it declares let externalMcpNames = [].

Step-by-Step Configuration Guide

Accessing the MCP Management Interface

Open the MCP Management page by clicking MCP → MCP Management in the left navigation. This button is rendered in the markup around line 620 in web/templates/index.html. To view currently registered servers, click the Refresh button which triggers loadExternalMCPs() defined in web/static/js/settings.js at lines 60-71.

Adding a New External MCP Server

Click Add external MCP to open the configuration modal. This button calls showAddExternalMCPModal() located around line 1309 in settings.js. The modal presents a JSON textarea where you must paste a properly structured configuration object.

The JSON must be an object whose keys are the MCP names and whose values are configuration objects. Required fields include:

• transport: Communication method ("stdio", "http", or "sse")
• command: Executable path for stdio transports (e.g., "python3")
• args: Array of command arguments (optional)
• url: Endpoint address for http or sse transports (e.g., "http://127.0.0.1:8081/mcp")
• description: Human-readable label displayed in the UI
• timeout: Request timeout in seconds (default 300)
• enabled: Boolean activation flag

Click Save to trigger saveExternalMCP() which validates the JSON and sends a PUT request to /api/external-mcp/<name> for each entry. The UI then polls up to five times via pollExternalMCPToolCount() (lines 61-73) until tools become available.

Editing and Removing Existing Servers

Each external MCP entry in the list includes Edit and Delete controls. The Edit button calls editExternalMCP(name) (lines 26-60 in settings.js), pre-filling the modal with current configuration data. Modify the JSON and click Save to update the server settings.

To remove a server, click the Delete icon which invokes deleteExternalMCP(name) at lines 73-97. After confirmation, the UI issues a DELETE request to /api/external-mcp/<name> and refreshes the list.

JSON Configuration Schema and Examples

Below is a valid configuration registering two external MCP servers—one using stdio transport and one using HTTP:

{
  "hexstrike-ai": {
    "command": "python3",
    "args": [
      "/opt/hexstrike/agent.py",
      "--server",
      "http://example.com"
    ],
    "description": "Hexstrike AI tool – runs locally via a Python script",
    "timeout": 300,
    "enabled": true
  },
  "cyberstrike-ai-http": {
    "transport": "http",
    "url": "http://127.0.0.1:8081/mcp",
    "description": "HTTP‑based MCP listening on port 8081",
    "timeout": 120,
    "enabled": true
  }
}

Paste this object into the modal textarea and click Save. The UI validates that the root is an object containing at least one named configuration, then verifies mandatory fields per transport type before submitting to the backend.

Behind the Scenes: API and Validation Logic

Client-Side Validation Flow

The saveExternalMCP() function in web/static/js/settings.js performs strict validation before API submission:

1. Non-empty check: Verifies JSON string exists (line 23)
2. Parse validation: Attempts JSON.parse (line 33)
3. Object shape check: Confirms typeof configObj !== 'object' (line 44)
4. Entry presence: Validates at least one named configuration exists (line 52)
5. Field verification: Ensures required fields (transport, command, url) are present based on transport type (lines 81-103)

Validation errors display immediately in the <div id="external-mcp-json-error"> element without submitting to the server.

REST API Endpoints

All network operations use the apiFetch helper with these standard patterns:

Action	Method	Endpoint
Create/Update	PUT	/api/external-mcp/<name>
Read List	GET	/api/external-mcp
Delete	DELETE	/api/external-mcp/<name>

The backend stores configurations and launches appropriate transports when tool requests arrive. The chat interface in web/static/js/chat.js merges external MCP names into tool suggestions around lines 462-677, making newly registered tools available immediately after the polling cycle completes.

Summary

• Navigate to MCP Management in the CyberStrikeAI UI to access external server controls
• Click Add external MCP and provide a JSON object with transport-specific fields (stdio requires command and args; http/sse require url)
• The UI validates configuration client-side in saveExternalMCP() before sending PUT requests to /api/external-mcp/<name>
• Edit existing servers via editExternalMCP() or remove them with deleteExternalMCP() which triggers DELETE requests
• The system polls automatically until tools appear in the chat interface

Frequently Asked Questions

What transport types does CyberStrikeAI support for external MCP servers?

CyberStrikeAI supports three transport methods as implemented in the validation logic: stdio for local command execution, http for REST API endpoints, and sse for Server-Sent Events connections. The transport field is auto-detected if omitted, but explicit declaration is recommended for clarity.

Where does CyberStrikeAI store external MCP configurations?

According to the source code in web/static/js/settings.js, configurations are sent to backend endpoints at /api/external-mcp/* via REST API calls. The UI itself does not persist data locally; storage and process management occur on the server side, with the UI maintaining only a client-side list in externalMcpNames within chat.js.

Why does my external MCP not appear in the chat interface immediately?

After saving a new configuration, saveExternalMCP() initiates a polling cycle via pollExternalMCPToolCount() that attempts up to five retries to fetch tool counts. If the server process fails to start or the endpoint is unreachable, the MCP will not appear in the chat tool list until the backend successfully launches the transport and registers the tools.

Can I configure multiple external MCP servers simultaneously?

Yes. The JSON input accepts an object with multiple keys, where each key represents a distinct MCP server name. The UI iterates through all entries in saveExternalMCP() and sends individual PUT requests to /api/external-mcp/<name> for each configured server in a single save operation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}