MCP servers

Tasuku supports remote MCP servers over HTTPS. Codex supports Streamable HTTP servers. Claude supports Streamable HTTP and legacy SSE servers. Tasuku rejects legacy SSE when Codex is selected instead of generating an unusable runtime configuration.

{
  "name": "linear",
  "transport": "HTTP",
  "url": "https://mcp.example.com/mcp",
  "headers": [
    { "name": "Authorization", "value": "Bearer ${secrets.LINEAR_TOKEN}" }
  ]
}

Header secrets

Header values may reference separately stored secrets. The configuration retains the reference; Tasuku resolves it for the invocation without returning the plaintext through read APIs.

A repository secret with the same name shadows the instance secret for that repository. This lets one shared MCP definition use repository-specific credentials.

Provider mapping

Tasuku converts the same logical MCP server into provider-specific Codex or Claude invocation configuration. Keep names unique and valid for the selected agent provider.

Safety

Only add servers you trust with the repository context the agent may send. HTTPS protects transport, but it does not make the remote service an internal Tasuku component. Review its retention, authorization, and tenant boundaries separately.

Local, plaintext HTTP, and arbitrary stdio transports are not accepted by the current configuration API.