> ## Documentation Index
> Fetch the complete documentation index at: https://fossa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Install custom MCP plugins

> Step-by-step instructions for connecting any custom Model Context Protocol plugin to Fossa.

## Why custom plugins matter

Custom MCP plugins let your team ground Fossy on internal systems—knowledge bases, incident dashboards, policy engines, you name it. Once installed, every Fossy interaction can call those tools with live data, so reviewers stop copying screenshots or stale snippets into pull requests.

This guide shows the opinionated flow we recommend for any custom plugin, whether it is a simple read-only endpoint (like the Fossa Docs MCP) or a more advanced pipeline with authentication.

<Callout icon="globe">
  Fossa supports **remote MCP servers only**—that means the plugin must be reachable from Fossa' infrastructure.
</Callout>

***

## Prepare your plugin info

Gather these details before opening the Plugins catalog:

| Field | Why it matters |
| - | - |
| **Public URL** | Endpoint where the MCP manifest is hosted (e.g., `https://acme-internal-tools.com/mcp`). |
| **Protocol** | MCP implementation type (HTTP or SSE). |
| **Hosting** | Must be a remote server accessible from Fossa (no localhost or desktop MCP endpoints). |
| **Authentication** | Whether the plugin requires API keys, OAuth, or is open to your workspace IPs. |
| **Description / Logo** | Helps other engineers understand what the plugin does when browsing the catalog. |

Looking for remote MCP servers to try out?

* [Smithery.ai](https://smithery.ai/) curates deployable MCP services plus an easy launcher you can point at your own infra.
* [Awesome Remote MCP Servers](https://github.com/sylviangth/awesome-remote-mcp-servers) lists community-maintained endpoints spanning docs search, security scanners, and workflow bots.

## Install the plugin in Fossa

<iframe src="https://www.youtube.com/embed/rtBxGnb9nIs?si=z2538VqglaqBOpio" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen width="100%" height="500px" />

1. Go to **Code Review Settings → Plugins** (beta) inside your Fossa workspace.

2. Click **Add Plugin**.

3. Fill in the form:

   ```text theme={null}
   Plugin Name: Descriptive label (e.g., "Security Runbooks MCP")
   Description: What data/actions it exposes
   Logo URL: Optional, but helpful for recognition
   URL: https://your-domain.com/mcp
   Protocol: HTTP or SSE
   Authorization / Headers: Add if your MCP host requires them (e.g., API key, OAuth, etc.) (optional)
   ```

4. Hit **Create Plugin**. Once it appears in the list, it is instantly available to the entire workspace.

<Warning>
  Custom plugins run with the same permissions as the workspace. Only install endpoints your organization trusts and monitors.
</Warning>

## Verify the connection

1. Open any pull request where Fossy is enabled.

2. Mention `@fossy` and include a question that forces the plugin to respond.

   ```
   @fossy can you fetch the deployment checklist from our MCP and confirm whether feature flags are required?
   ```

3. In the drawer, check the **Plugins** section. You should see a call to your new plugin. If it fails, expand the error to inspect the status code or validation message.

<Info>
  The Fossa Docs MCP (`/mcp`) is a quick sanity test—you can install it first to ensure your workspace can reach external hosts.
</Info>

***

## Quick checklist

* [ ] Plugin manifest is hosted and reachable.
* [ ] Auth model (if any) is documented and tested.
* [ ] Plugin is installed via **Add Custom Plugin** with the right URL + headers.
* [ ] A sample PR proved Fossy can call the plugin.
* [ ] Owners know how to monitor and update the integration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.