Use your in-house MCP server from Grok

What this guide covers

We will make the MCP server running on your local (in-house) machine usable from Grok — without opening any inbound ports. The flow has 4 parts: create a canal in WireCanal → start the Agent → register the connector in Grok → approve the connection.

• check_circleA WireCanal account (MCP canals can be created on any plan)
• check_circleAn MCP server running locally (Streamable HTTP, e.g. http://localhost:9310/mcp)
• check_circleA paid Grok plan (a tier that supports custom connectors; a paid X account also works)

First, set things up on the WireCanal side

On the dashboard, click "Create a new canal", choose MCP as the type, and click "Next".

Just pick the AI you will use, and the connection settings for that AI are prepared automatically. Here, check Grok.

For the public address (hostname), the "auto-assigned subdomain" is fine. You can also reserve a name of your choice or use a custom domain.

For the forwarding target, enter the address of the MCP server running on your machine (e.g. localhost:9310).

Right after creation, the "MCP connection" tab shows the client ID and client secret for the Grok connection (the secret is shown only this once). For the normal flow below you will not need them — Grok registers itself with WireCanal automatically. Note them down only if you plan to configure the OAuth settings manually.

Download the configuration file wirecanal.json from the "Setup" tab, and list only the tool names you are willing to show to the outside AI in tools.allow (the default is deny-all). For the syntax and all options, see the wirecanal.json configuration reference.

{
  "access_key": "ck_...",
  "forward_target": "localhost:9310",
  "mode": "mcp",
  "tools": { "default": "deny", "allow": ["get_time", "echo"] }
}

Start the Agent on the same machine. No inbound ports need to be opened. If you have not installed the Agent yet, or want to keep it running as a service (auto-start), see the OS-specific setup guides.

wirecanal.exe -config wirecanal.json

When the startup log shows a line saying that canal <ID> will deliver access to https://<hostname> to your local forwarding target, the connection is established.

Setting up on the Grok side

On grok.com, open "Skills and Connectors" in the left menu → "New Connector", and choose "Custom (add your own custom connector)".

Enter a name (anything you like) and the Server URL (the canal's public URL + /mcp, e.g. https://<hostname>/mcp), then click "Add Connector". Grok registers itself with WireCanal automatically (no client ID or secret to paste), and WireCanal's connection-consent screen opens in a popup window.

In the popup, review the details and simply click "Approve". Only the canal owner can grant approval.

When your connector shows Connected under the "Installed" section of "Skills and Connectors", the connection is complete.

Just mention the connector by name in a chat and call the tool. For example, ask "Use get_time to tell me the current time in Japan" — and the real data returned by your local MCP server is used in Grok's answer.