Learn how to configure Cribl AI to connect to external MCP servers, making third-party tools available to Cribl AI agents during conversations.

Overview ​

Cribl AI can connect outward to external MCP servers. Once configured, the tools those servers expose become available to Cribl AI agents. For example, Riptide (the Cribl Search AI assistant) can query external data sources or trigger actions in third-party systems directly from a conversation.

This is distinct from the Cribl MCP server, which lets external MCP clients (such as Cursor or Claude Desktop) connect inward and query your Cribl environment.

Currently, Cribl Search investigations is the only Cribl AI feature that uses external MCP integrations. Other Cribl AI features do not call tools from configured MCP servers.

Prerequisites ​

• Cribl AI consent enabled
• Admin or Owner role in your Cribl Organization

Access MCP Integrations Settings ​

1. Select Settings, then select AI Settings.
2. Select Manage Integrations.

The MCP Integrations page lists all configured external MCP server connections.

Add an MCP Integration ​

1. Select Add Integration.

2. Complete the following fields:

   Field	Description
   ID	A unique identifier for this integration.
   Display Name	A human-readable label shown in the UI.
   Endpoint URL	The Server-Sent Events (SSE) or Streamable HTTP endpoint URL of the external MCP server.
   Headers	(Optional) Key-value pairs sent with each request. Use this to supply authentication credentials, for example Authorization: Bearer <token> or a custom API key header.

3. Select Save.

Header values are encrypted at rest. Cribl stores the integration configuration in ai.yml under the mcp.servers key:

mcp:
  servers:
    - id: my-integration
      displayName: My MCP Server
      url: https://mcp.example.com/sse
      enabled: true
      headers:
        Authorization: "<encrypted>"

Enable or Disable an MCP Integration ​

On the MCP Integrations page, use the toggle next to an integration to enable or disable it without removing its configuration. Disabling an integration stops Cribl AI agents from using its tools while preserving the saved endpoint URL, headers, and other settings. Re-enable the integration at any time to make its tools available again.

This toggle corresponds to the enabled field in the stored configuration (shown in the preceding ai.yml example).

Delete an MCP Integration ​

Select the delete action next to the integration you want to remove. MCP integrations cannot be edited in place. To update the configuration of an integration, delete it and re-add it. If you only need to temporarily stop using an integration, disable it instead of deleting it.

Connection Lifecycle ​

When a Cribl AI agent uses tools from an MCP integration, Cribl establishes an SSE connection to the external MCP server. It discovers available tools using the standard MCP tools/list operation. Connections are cached and reused. Connections that are idle for 5 minutes are automatically disconnected and transparently re-established on the next tool call. All active connections are closed cleanly when the Cribl process shuts down.

Use Case Examples ​

To learn how to expose your Cribl environment to external MCP clients instead, see Work with the Cribl MCP Server.