Fleet runs its own in-process fleet server, which is what gives an orchestrator its tools. On top
of that you can configure your own MCP servers, over stdio, HTTP or SSE.
If MCP is new, MCP explained covers what it is before this page covers what Fleet does with it.
Two scopes, and the difference is trust
An MCP server is an arbitrary command Fleet will run. So where a definition came from is part of the definition, and Fleet tracks it.
| Scope | Where it came from | Default |
|---|---|---|
| User | Typed into Settings by you | Enabled |
| Repo | Declared in a repository's .fleet/settings.json | Disabled |
A server you typed into Settings is yours and is trusted the way your shell profile is. A server declared inside a repository is repo content, which is the untrusted category this app is careful about everywhere else, so it arrives disabled and stays that way until you say otherwise.
The repository file's own enabled flag is ignored outright. It is not the party being trusted.
Approval is keyed to the definition, not the name
When you enable a repo-declared server, Fleet records a fingerprint of the definition: the command, its arguments, its environment, its URL.
Recording only "the user enabled linear" would let a later edit to that file swap the command and
inherit the approval silently. Change the definition and it needs approving again, which is the
whole point.
Configuring one
In Settings, a server has a name, a transport, and then either a command with arguments and
environment, or a URL with headers. A stdio command may be an absolute path or a bare name resolved
on your login shell's PATH, which is the same PATH resolution that keeps gh and claude working
in a packaged app.
Fleet shows the state of each server: off, starting, ready, or failed. Once one has handshaked, it also shows how many tools it added, so you can see what it actually contributed rather than trusting that it did something.
A server that is enabled but incomplete, a stdio entry with no command or an HTTP entry with no URL, is not started.
What an MCP server can do
Whatever it is written to do. It is a program on your machine with your privileges, or a remote endpoint you have pointed Fleet at. Fleet does not sandbox it and does not filter what it sends. Adding one is the same class of decision as adding a shell alias that runs on every prompt.