Install custom MCP plugins

​

Why custom plugins matter

Custom MCP plugins let your team ground Fossy on internal systems—knowledge bases, incident dashboards, policy engines, you name it. Once installed, every Fossy interaction can call those tools with live data, so reviewers stop copying screenshots or stale snippets into pull requests. This guide shows the opinionated flow we recommend for any custom plugin, whether it is a simple read-only endpoint (like the Fossa Docs MCP) or a more advanced pipeline with authentication.

---

​

Prepare your plugin info

Gather these details before opening the Plugins catalog: Looking for remote MCP servers to try out?

• Smithery.ai curates deployable MCP services plus an easy launcher you can point at your own infra.
• Awesome Remote MCP Servers lists community-maintained endpoints spanning docs search, security scanners, and workflow bots.

​

Install the plugin in Fossa

1. Go to Code Review Settings → Plugins (beta) inside your Fossa workspace.
2. Click Add Plugin.
3. Fill in the form:
   Plugin Name: Descriptive label (e.g., "Security Runbooks MCP")
   Description: What data/actions it exposes
   Logo URL: Optional, but helpful for recognition
   URL: https://your-domain.com/mcp
   Protocol: HTTP or SSE
   Authorization / Headers: Add if your MCP host requires them (e.g., API key, OAuth, etc.) (optional)
   
4. Hit Create Plugin. Once it appears in the list, it is instantly available to the entire workspace.

​

Verify the connection

1. Open any pull request where Fossy is enabled.
2. Mention @fossy and include a question that forces the plugin to respond.
   @fossy can you fetch the deployment checklist from our MCP and confirm whether feature flags are required?
   
3. In the drawer, check the Plugins section. You should see a call to your new plugin. If it fails, expand the error to inspect the status code or validation message.

---

​

Quick checklist

• Plugin manifest is hosted and reachable.
• Auth model (if any) is documented and tested.
• Plugin is installed via Add Custom Plugin with the right URL + headers.
• A sample PR proved Fossy can call the plugin.
• Owners know how to monitor and update the integration.