> ## Documentation Index
> Fetch the complete documentation index at: https://latch.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Upstreams

> Connect and manage your MCP servers.

An **upstream** represents an integration that Latch protects.

* For **MCP**, an upstream is an MCP server registration.
* For **OpenClaw**, we recommend creating a dedicated upstream (e.g. `openclaw-native`) to scope policies for OpenClaw native tools.

Latch enforces your security policies on all requests that are scoped to that upstream.

## What is an Upstream?

Think of an upstream as a "protected server registration." It tells Latch:

* **What** MCP server to connect to
* **How** to connect (stdio command or HTTP URL)
* **Which tools** that server exposes

**AI Agent (Claude)** → **Latch (proxy)** → **Upstream (MCP Server)**

## Creating an Upstream

1. Go to **Upstreams** in the dashboard
2. Click **Create Upstream**
3. Choose your transport type:

### Stdio Upstreams (Local)

For MCP servers that run as local processes (most common):

* **Name**: A label for this upstream (e.g., `filesystem`, `github`)
* **Command**: The command to run (e.g., `npx`)
* **Args**: Command arguments (e.g., `-y,@modelcontextprotocol/server-filesystem,/tmp`)

<Note>
  For stdio upstreams, the command/args are only used for tool discovery. The actual server is spawned by the CLI when your agent connects.
</Note>

### HTTP Upstreams (Remote)

For MCP servers running as web services:

* **Name**: A label for this upstream
* **URL**: The server's HTTP endpoint
* **Headers**: Authentication headers (API keys, Bearer tokens)

## Importing from Claude Desktop / Cursor

Already have MCP servers configured? Import them directly:

1. Go to **Upstreams** → **Import MCP config**
2. Paste your `mcpServers` JSON from Claude Desktop or Cursor config
3. Select which server to import

**Claude Desktop config location:**

```
~/Library/Application Support/Claude/claude_desktop_config.json
```

## Tool Discovery

Latch needs to know what tools an upstream exposes so you can create per-tool rules.

<Note>
  OpenClaw native tools are not MCP tools. For OpenClaw, Latch provides a curated picker of common native tools (and supports additional plugin tools via configuration).
</Note>

| Transport | Discovery Method                                               |
| --------- | -------------------------------------------------------------- |
| **HTTP**  | Automatic on save. Re-run via **Sync Tools** button.           |
| **Stdio** | Happens when the CLI connects. Or run manual sync (see below). |

### Manual Tool Sync (Stdio)

To discover tools before connecting an agent:

```bash theme={null}
npx @latchagent/cli@latest tools-sync \
  --api-key "latch_YOUR_KEY" \
  --upstream "my-upstream" \
  --upstream-command "npx" \
  --upstream-args "-y,@modelcontextprotocol/server-filesystem,/tmp"
```

After syncing, tools appear in the **Tools** page and in rule dropdowns.

## Exporting Client Configs

Once an upstream is configured, export a ready-to-use config for your MCP client:

1. Go to **Upstreams**
2. Click **Export** on the upstream row
3. Choose your client format (Claude Desktop, Cursor, etc.)
4. Paste into your client's config file

The export wraps your upstream through Latch, so all requests are protected.

## Common Upstream Examples

### Filesystem Server

```json theme={null}
{
  "name": "filesystem",
  "transport": "stdio",
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me/projects"]
}
```

### GitHub Server

```json theme={null}
{
  "name": "github",
  "transport": "stdio",
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-github"]
}
```

### Remote HTTP Server

```json theme={null}
{
  "name": "my-api",
  "transport": "http",
  "url": "https://mcp.example.com/api",
  "headers": {
    "Authorization": "Bearer sk-..."
  }
}
```

## Next Steps

Once you've created an upstream:

1. [Sync its tools](#tool-discovery) so Latch knows what it exposes
2. [Create rules](/rules) to control what actions are allowed
3. [Export the config](#exporting-client-configs) to your MCP client