Connector transport
The Desktop MCP transport section of a profile controls how Harriet Desktop reaches each eligible MCP connector: Proxied (via Harriet) routes traffic through Harriet, while Direct lets the device call the MCP URL itself.
The two transports
By default, connector traffic is proxied: the desktop talks to Harriet's per-user MCP endpoint, and Harriet forwards each tool call to the underlying integration. Direct is an opt-in override, available only where Harriet marks the integration as safe for direct access.
| Proxied (via Harriet) | Direct | |
|---|---|---|
| Who talks to the MCP server | Harriet, on the device's behalf | The device itself |
| Credentials | Held by Harriet (the org-level secret key or the person's OAuth connection); the device carries only a proxy token | None — only unauthenticated servers qualify |
| Audit trail | Every tool call is logged in the audit log | Calls do not pass through Harriet, so they are not audited |
| Availability | Every MCP connector | Unauthenticated native HTTP MCP integrations only |
What proxying adds
Proxied is the governed path. Harriet resolves the right credentials for each call — the organization's secret key, or per-user OAuth tokens for connectors that require an individual sign-in — so secrets never live on the device. The desktop configuration carries only a per-user, per-server, per-device proxy token, which Harriet uses to resolve the integration and credentials on each call.
Because every call passes through Harriet, each one lands in the audit log: who called which tool, from which device, and whether it worked. Proxying is also where tool permissions take effect, since Harriet sees the call before the integration does.
What direct means
With Direct, Harriet Desktop calls the MCP server's URL itself, with no Harriet hop in between. Only unauthenticated native HTTP MCP integrations can offer this option; OAuth and other authenticated integrations always use the proxy, because their credentials live in Harriet, not on the device. Choose Direct when the connector holds nothing sensitive and you value the shorter network path — an internal read-only service on your own network is the typical case. Keep Proxied wherever you want the audit trail.
Setting an override
- Open the profile. Go to Manage → Profiles and select the profile, then scroll to Desktop MCP transport.
- Add the connector. Use Add integration override… and pick an eligible integration. New overrides start as Proxied (via Harriet).
- Choose the transport. In the row's Transport select, switch between Proxied (via Harriet) and Direct. Direct only appears for integrations that allow it.
Overrides are per profile, so the same connector can be Direct for one team's profile and Proxied for another's. Remove an override to return the connector to standard behavior for that profile.
Seeing "Nothing to configure here yet"? The section only activates when your organization has at least one MCP integration that allows choosing direct vs proxied transport. To add a direct-capable MCP server, connect it under Company settings → Integrations — see Custom MCP servers.