All Products
Search

This Product

    STAROps:MCP service configuration

    Document Center

    STAROps:MCP service configuration

    Last Updated:Jun 15, 2026

    This topic describes how to add and configure MCP (Model Context Protocol) services for a Digital Employee, enabling the Digital Employee to access external systems and data sources.

    What is an MCP service

    MCP (Model Context Protocol) is an open standard protocol for connecting Digital Employees with external systems and data sources. Through MCP services, Digital Employees can securely access databases, APIs, cloud services, and other external resources to execute queries, perform operations, and automate tasks.

    Features

    Feature

    Description

    Standardized interface

    Based on an open protocol, provides a unified access method across different systems.

    Tool invocation

    Digital Employees can directly call tools provided by MCP services to perform operations.

    Security control

    Supports tool-level permission management and execution mode configuration.

    Real-time interaction

    Communicates with external systems in real time to retrieve the latest data.

    Concepts

    Term

    Description

    MCP service

    A server-side program that implements the MCP protocol and provides a set of callable tools.

    MCP tool

    A specific function exposed by an MCP service, such as querying data or executing operations.

    AI Gateway

    A middleware layer that manages and routes MCP service requests, providing security and traffic control.

    Function Compute (FC)

    An Alibaba Cloud serverless computing service that can be used to deploy MCP services.

    Model Studio

    Alibaba Cloud's large language model service platform that provides managed MCP tool services.

    Execution mode

    The confirmation mechanism for tool invocation. Two modes are available: automatic execution and ask-before-each-call.

    Network configuration

    Security group: If no security group is available, go to the security group console to create one.

    MCP service address: The service access endpoint, for example https://<endpoint>:443 (TCP) or http://<endpoint>:80 (TCP).

    Tool list: The available tools provided by the MCP service. If the tool list is inaccurate, go to the gateway console and click Sync Tools.

    How MCP services work

    MCP services use a client-server architecture:

    1. Service registration: After an MCP service is deployed, available tools are registered through AI Gateway, Function Compute, or a custom MCP endpoint.

    2. Tool discovery: The Digital Employee retrieves the list of available tools from the configured service endpoint.

    3. Tool invocation: The Digital Employee selects and calls the appropriate tool based on the user request.

    4. Result return: The MCP service executes the operation and returns the result to the Digital Employee.

    Prerequisites

    • At least one Digital Employee has been created. For more information, see Create a Digital Employee.

    • An MCP service has been deployed and is running. The MCP service can be deployed in the following environments:

      • A server accessible over the public internet

      • An ECS instance or ACK cluster within an Alibaba Cloud VPC (requires VPC mode)

      • Function Compute (FC)

      • Model Studio managed MCP tools

    • If you use VPC mode, prepare the following network information:

      • The VPC ID where the MCP service resides

      • The security group ID

      • The private IP address and listening port of the MCP service

    Note

    Direct mode requires the MCP service endpoint to be publicly accessible. VPC mode is suitable for private ECS or ACK environments. The system creates or reuses a reverse access tunnel but is subject to availability zone resource constraints. Choose the appropriate access mode based on your network environment.

    Add an MCP service

    The process involves four steps: select the network mode → enter the service address → retrieve the tool list → select the callable tools.

    STAROps supports two network modes:

    Network mode

    Use case

    Availability zone restriction

    Configuration complexity

    Direct mode

    Endpoints that are already directly accessible, such as public MCP services, Function Compute, and Model Studio MCP

    None

    Low

    VPC mode

    Private ECS or ACK environments where the MCP service is deployed within a VPC

    Restricted to supported availability zones

    Medium

    Direct mode

    Direct mode is suitable for scenarios where you have a self-hosted MCP server with a publicly accessible endpoint.

    1. Log on to the STAROps console.

    2. In the left-side navigation pane, click Digital Employees.

    3. In the Digital Employee list, click the target Digital Employee to go to its details page.

    4. Click the MCP Service tab, and then click Add MCP Service.

    5. Enter basic information.

      Parameter

      Required

      Description

      Service name

      Yes

      Used to save and display this MCP service. Cannot be edited after creation.

      Display name

      No

      Used for display purposes. Can differ from the service name. If left blank, the service name is used.

      Service description

      No

      Describes the capabilities of this service. Displayed in the MCP service details.

    6. Under Network mode, select Direct mode.

    7. Configure the service address and protocol.

      Parameter

      Required

      Description

      Access endpoint

      Yes

      Enter the complete MCP endpoint, for example http://8.136.*.*:8080/mcp. The access endpoint must be a publicly accessible URL.

      Transport protocol

      Yes

      Select HTTP or SSE. HTTP typically uses the /mcp path, and SSE typically uses the /sse path. The protocol must match the server-side implementation.

      Authentication

      No

      No authentication by default. If the MCP service requires authentication, select Token and enter the password.

    8. Click Get Tool List. After confirming the tool list is correct, configure the execution mode for each tool. For details, see the Execution mode section.

    9. Click Add Now.

    VPC mode

    VPC mode is suitable for private ECS or ACK environments. The system creates or reuses a reverse access tunnel to establish connectivity from STAROps to MCP services within the VPC.

    1. Log on to the STAROps console.

    2. In the left-side navigation pane, click Digital Employees.

    3. In the Digital Employee list, click the target Digital Employee to go to its details page.

    4. Click the MCP Service tab, and then click Add Service.

    5. Enter basic information.

      Parameter

      Required

      Description

      Service name

      Yes

      Used to save and display this MCP service. Cannot be edited after creation.

      Display name

      No

      Used for display purposes. Can differ from the service name. If left blank, the service name is used.

      Service description

      No

      Describes the capabilities of this service. Displayed in the MCP service details.

    6. Under Network mode, select VPC mode.

    7. Configure the network information.

      Parameter

      Required

      Description

      VPC

      Yes

      Select the region first, then select the VPC in that region where the MCP service resides. The system creates or reuses a reverse access tunnel. For supported regions, see the table below.

      VSwitch availability zone

      Yes

      Select the VSwitch availability zone in the target region. After selecting a VPC, the system automatically lists the supported availability zones for that region. The selected availability zone is used to establish the access tunnel from STAROps to the MCP service in the VPC. The VSwitch does not need to be in the same availability zone as the MCP service.

      VSwitch

      Yes

      Select a VSwitch in the specified availability zone. The VSwitch and security group are used to establish the access path from STAROps to the MCP service within the VPC.

      Security group

      Yes

      Select the security group used by the MCP service. The inbound rules of the security group must allow traffic on the MCP service port.

      Supported regions and availability zones for VPC mode

      VPC mode is currently available in selected regions only. The following table lists the supported availability zones for each region.

      Region

      Region ID

      Supported availability zones

      China (Beijing)

      cn-beijing

      cn-beijing-g, cn-beijing-h

      China (Hangzhou)

      cn-hangzhou

      cn-hangzhou-j, cn-hangzhou-k

      China (Shanghai)

      cn-shanghai

      cn-shanghai-b, cn-shanghai-g

      China (Shenzhen)

      cn-shenzhen

      cn-shenzhen-e, cn-shenzhen-f

      China (Zhangjiakou)

      cn-zhangjiakou

      cn-zhangjiakou-a, cn-zhangjiakou-b

      China (Ulanqab)

      cn-wulanchabu

      cn-wulanchabu-a, cn-wulanchabu-b

      Singapore

      ap-southeast-1

      ap-southeast-1a, ap-southeast-1b

      China (Hong Kong)

      cn-hongkong

      cn-hongkong-b, cn-hongkong-c

      Japan (Tokyo)

      ap-northeast-1

      ap-northeast-1a, ap-northeast-1b

      Shanghai Financial Cloud

      cn-shanghai-finance-1

      cn-shanghai-finance-1f, cn-shanghai-finance-1k

      Thailand (Bangkok)

      ap-southeast-7

      ap-southeast-7a, ap-southeast-7b

      China (Chengdu)

      cn-chengdu

      cn-chengdu-a, cn-chengdu-b

      UAE (Dubai)

      me-east-1

      me-east-1a, me-east-1b

      Shanghai Cloud Box

      cn-shanghai-cloudspe

      cn-shanghai-cloudspe-a, cn-shanghai-cloudspe-b

      Mexico

      na-south-1

      na-south-1a

      China (Heyuan)

      cn-heyuan

      cn-heyuan-a, cn-heyuan-b

      Germany (Frankfurt)

      eu-central-1

      eu-central-1a, eu-central-1b

      Shenzhen Financial Cloud

      cn-shenzhen-finance-1

      cn-shenzhen-finance-1d, cn-shenzhen-finance-1e

      Philippines (Manila)

      ap-southeast-6

      ap-southeast-6a

      China (Guangzhou)

      cn-guangzhou

      cn-guangzhou-a, cn-guangzhou-b

      Korea (Seoul)

      ap-northeast-2

      ap-northeast-2a, ap-northeast-2b

      China North 2 Ali Gov Cloud 1

      cn-north-2-gov-1

      cn-north-2-gov-1c, cn-north-2-gov-1d

      Hangzhou Financial Cloud

      cn-hangzhou-finance

      cn-hangzhou-finance-i, cn-hangzhou-finance-j

      China (Hohhot)

      cn-huhehaote

      cn-huhehaote-a, cn-huhehaote-b

      Indonesia (Jakarta)

      ap-southeast-5

      ap-southeast-5a, ap-southeast-5b

      Beijing Financial Cloud

      cn-beijing-finance-1

      cn-beijing-finance-1k, cn-beijing-finance-1l

      China (Wuhan - Local Region)

      cn-wuhan-lr

      cn-wuhan-lr-a

      China (Zhongwei)

      cn-zhongwei

      cn-zhongwei-a

      UK (London)

      eu-west-1

      eu-west-1a, eu-west-1b

      China (Qingdao)

      cn-qingdao

      cn-qingdao-b, cn-qingdao-c

      Malaysia (Johor)

      ap-southeast-8

      ap-southeast-8a

      Malaysia (Kuala Lumpur)

      ap-southeast-3

      ap-southeast-3a, ap-southeast-3b
      Important

      VPC mode requires creating a reverse access tunnel in your VPC. This operation is subject to availability zone resource constraints. If resources are insufficient in the selected availability zone, the creation will fail. We recommend confirming resource availability in the target availability zone before configuration.

    8. Configure the service address and protocol.

      Parameter

      Required

      Description

      Access address

      Yes

      Enter the private IP address of the MCP service accessible within the ECS or ACK environment. A public IP address is not required.

      Access port

      Yes

      Enter the listening port of the MCP service, for example 8080.

      Access endpoint

      Yes

      Enter the complete MCP endpoint, for example http://10.0.1.23:8080/mcp. The address and port must match the values entered above.

      Transport protocol

      Yes

      Select HTTP or SSE. The protocol must match the server-side implementation.
      Note

      The address entered here is the VPC private IP address, for example the IP address of a private SLB or Pod IP. Do not enter a public IP address.

    9. Click Get Tool List. After confirming the tool list is correct, configure the execution mode for each tool. Click OK.

    Execution mode

    After adding an MCP service, the system automatically retrieves the list of tools provided by the service. You must configure an execution mode for each tool to control the confirmation mechanism when the Digital Employee calls the tool. Each MCP tool supports the following two execution modes:

    Execution mode

    Description

    Applicable scenarios

    Automatic execution

    The Digital Employee calls the tool automatically without requiring user confirmation.

    Low-risk read operations, such as querying monitoring metrics or reading logs.

    Ask before each call

    User confirmation is required before each tool invocation.

    High-risk write operations, such as restarting an instance or modifying a configuration.

    We recommend configuring Ask before each call mode for all write operations (create, modify, delete) to prevent the Digital Employee from automatically executing changes that may have unintended effects.

    FAQ

    Connection timeout when adding an MCP service

    1. Verify that the MCP service address format is correct and includes the complete protocol, IP address or domain name, port, and path (for example, http://xx.xx.xx.xx:8080/mcp).

    2. Confirm that the MCP service is running and the port is listening normally.

    3. If you are using direct mode, check whether the public endpoint is reachable. You can run the following command to test connectivity:

      curl -X POST http://<MCP service address>/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}},"id":1}'

Example response: {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"tools":{}},"serverInfo":{"name":"k8s-mcp","version":"0.1.0"}}}

    4. If you are using VPC mode, verify that the VPC, VSwitch, and security group configurations are correct, and that the security group outbound rules allow traffic on the MCP service port.

    Tool list is empty or tool sync fails

    The tool list depends on the tool registration information on the MCP server. If the list is empty or incomplete, try the following:

    1. Confirm that the MCP server has correctly registered the tools and that the service is running.

    2. Click Get Tool List to manually trigger a refresh.

    MCP service status shows unavailable

    An unavailable MCP service status is typically caused by one of the following:

    • The server process has exited unexpectedly or has not started. Check the running status of the MCP service.

    • Certificate expiry or authentication failure. If you are using an HTTPS endpoint, verify that the TLS certificate is valid.

    • Function Compute cold-start timeout. MCP services deployed on Function Compute may time out on the first call. Retry to resume normal operation.