Configure sources

Sources are the content types your end users can connect to their MCP servers. Use SDK source configuration to control what kinds of context users can add.

Audience	SDK implementers, product engineers
Prerequisites	A working SDK embed, client credentials, and a source policy for your end users

Source configuration

All 5 source types are enabled by default. Disable specific types to narrow the experience:

MCPStudio.init({
  clientId: "YOUR_CLIENT_ID",
  container: "#mcp-studio-widget",
  sources: {
    mcp: false,   // Hide MCP server federation
    api: false,   // Hide API endpoint type
  },
});

Available source types

Type	Key	Description
Website	website	Any public website or documentation site
GitHub Repository	github	Public or private GitHub repositories
Documentation	docs	Structured documentation sites (Docusaurus, ReadTheDocs, etc.)
API Endpoint	api	REST or GraphQL API documentation
MCP Server URL	mcp	Connect to another MCP server (federation)

Plan limits

Each MCP server created by your end users can have a maximum of 2 included sources. After that, each additional source is billed at $3. Source guidelines also apply:

• Large websites can require longer indexing windows depending on crawl size. Indexing runs in the background and does not require the embed UI to stay open.
• Private GitHub repos require authentication from the end user.
• Source content is periodically refreshed. Unchanged pages skip re-embedding.

info

At least 1 source type must be enabled for the wizard to function.

Private GitHub repos in the embed

The SDK widget reuses the same private-repo flow as the main MCP Studio wizard:

1. When the end user pastes a GitHub URL, the embed calls POST /mcp-studio-sdk/api/sdk/check-source which proxies to the main app's accessibility probe.
2. If the repo is private and the end user has not yet linked GitHub, the wizard shows a Sign in with GitHub button. The user is redirected to MCP Studio for OAuth and bounces back to the embed.
3. After verification, the source is created with an isPrivate: true flag. The widget surfaces a lock badge.
4. Crawl errors (auth_required, not_found, rate_limited, network) are exposed inline next to the source so the end user can re-link GitHub or refresh.

The proxy intentionally does not forward your SDK auth cookies to the main app — the main app sees an unauthenticated probe, which is sufficient to detect public-vs-private. End-user GitHub auth always happens against MCP Studio directly.

Recommended configurations

Documentation products

sources: {
  api: false,
  mcp: false,
}

Developer tools

sources: {
  mcp: false,  // Keep it simple — hide federation
}