--- title: Managing MCP Servers slug: kronpam-reference-guide-3-9-0/managing-mcp-servers docTags: createdAt: 2026-10-14T13:52:56.558Z --- Kron PAM lists the registered MCP servers on the **MCP Servers** tab. To open the tab, navigate to **Devices** > **Inventory** and click the **MCP Servers** tab. The **Server Groups** panel on the left lists the MCP Server Groups. Select a group to filter the **Servers** list. ![MCP Servers](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/vWktmDet1YPsY3Av7dzdt_mcp-servers.png) ### Adding an MCP Server Register each MCP server that users reach through the gateway. Kron PAM stores the outbound credential of the server and never shows it to the users of AI clients. To add an MCP server: 1. Navigate to **Devices** > **Inventory**. 2. Click the **MCP Servers** tab. 3. Click the **Add** button. 4. In the **Information** section, fill in the fields described in Table 4. 5. Expand the **Group Members** section and select one or more MCP Server Groups in the **Group(s)** field. 6. Click the **Save** button. ![Edit MCP Server](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/GR6wDPCSwiI9Wr31C7n6X_edit-server.png) ## Editing MCP Servers ![Edit MCP Server](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/GR6wDPCSwiI9Wr31C7n6X_edit-server.png) | **Field** | **Description** | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Name (required) | The name of the MCP server. | | Description | An optional description of the server. | | Upstream URL (required) | The MCP endpoint of the upstream server, for example *https\://learn.microsoft.com/api/mcp*. | | Outbound Auth Method (required) | The method that the gateway uses to authenticate to the MCP server. Table 5 lists the methods. | | Outbound Credential | The token or password that the gateway sends to the MCP server. The field appears when the selected method requires a credential. | | Client Certificate | The client certificate for the mTLS method. Click the upload icon in the field to select the certificate file. | | Owner | The user who owns the MCP server record. Kron PAM uses the value for auditing only. | | Enabled | The status of the server. Kron PAM rejects every gateway request for a disabled server, even when a Realm authorizes the user. | ### Outbound Authentication Methods | **Method** | **Description** | | ---------- | ----------------------------------------------------------------------------------- | | None | The gateway connects without credentials. Use this method for public MCP servers. | | Basic | The gateway authenticates with a username and a password. | | Bearer | The gateway sends the value of the **Outbound Credential** field as a bearer token. | | mTLS | The gateway authenticates with the client certificate that you upload. | ### MCP Server Actions Click the icon in the **Actions** column of a server to open the **Choose Action** modal. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/J5SmLrQxxjv4sHGu6oZ3Y_choose-action.png) | **Action** | **Description** | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Edit Server | Opens the server definition for editing. | | Delete Server | Deletes the server definition after confirmation. | | View Tools | Opens the cached tool catalog of the server. | | Test Connection | Connects to the upstream URL with the saved outbound authentication method and shows the result as a success or failure notification. The test does not evaluate Realms. | | Disable Server / Enable Server | Changes the status of the server. Kron PAM denies every gateway request for a disabled server. | ### Viewing and Refreshing the Tool Catalog Kron PAM keeps a cached catalog of the tools that each MCP server exposes. The gateway answers the list\_tools requests of AI clients from this cache, and administrators review the cache in the **View Tools** modal. To view and refresh the tools of an MCP server: 1. Navigate to **Devices** > **Inventory** and click the **MCP Servers** tab. 2. Click the icon in the **Actions** column of the server. 3. Click **View Tools**. The modal lists the **Tool Name**, **Description**, **Input Schema**, and **Tags** of each cached tool. 4. Click a truncated value to open the full text in the **Information** modal. 5. Click the **Refresh Tools** button to discover the tools of the server again. When the discovery succeeds, Kron PAM updates the cache and shows the "Tools refreshed" notification. ![MCP Server Tool Catalog](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/34YYI9VREZuuzR-m93Gxs_tool-catalo.png) ### Scheduling Tool Discovery The **MCP Tool Discovery Job** refreshes the tool catalogs of all enabled MCP servers on a schedule. The job uses the same discovery mechanism as the **Refresh Tools** button. To schedule tool discovery: 1. Navigate to **Administration** > **Job Scheduler**. 2. Click the **Trigger List** tab, then click the **Add Trigger** button. 3. Select *McpToolDiscoveryJob* from the **Job** list. 4. Enter a **Trigger Name**, for example *MCP Tool Catalog Hourly Sync*. 5. Enter a **Cron Expression** for the frequency of the job. 6. Set the trigger to active and save it. To run the job immediately, select **Options** > **Trigger Now** on the trigger. Review the results on the **Logs** tab of the Job Scheduler. ### Authorizing Access with Realms Realms connect Kron PAM user groups to MCP Server Groups. A user can use an MCP server through the gateway only when an enabled Realm contains a user group of the user and an MCP Server Group that includes the server. To create an MCP Realm: 1. Navigate to **Policy** > **Realms**. 2. Click the **Add** button. 3. Enter the **Realm Name** and an optional description. 4. Select the user groups that need access. 5. Select the MCP Server Groups that the user groups can access. 6. Save the Realm. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/g9gB_R1EAStYVO5ja6nnL_realm.png) On the **Realms** page, the MCP Server Groups of a Realm appear in the **Device Group(s)** column. **Authorization Order** The gateway checks every request in the following order: - First priority: the MCP\_GATEWAY license. Without the license, the gateway rejects the request before authentication. - Second priority: a valid gateway session. Without a session, the gateway returns a sign-in link. - Third priority: the status of the MCP server. The gateway rejects every request for a disabled server, even when a Realm authorizes the user. - Last priority: the Realms. The gateway forwards the request when at least one enabled Realm matches the user and the server.