Dify talks to Agent Update over MCP. The server is https://api.tryagentupdate.com/v1/mcp, the transport is Streamable HTTP, and the credential is one header.
Where it goes: Integrations -> Tools -> MCP -> add a server
Setup
URL : https://api.tryagentupdate.com/v1/mcp
Name : Agent Update
Server Identifier : agent-update
Advanced Options → Custom Headers
Authorization = Bearer au_live_... ← full value, including "Bearer"
Authentication → Dynamic Client Registration: LEAVE AT DEFAULT (on)Before you file a bug
Do not turn Dynamic Client Registration off. That toggle is the bring-your-own-OAuth-app path and will prompt for a Client ID and Secret you do not have. Custom Headers is an independent Advanced Option, so fill that in and leave the Authentication section alone. The header value is the complete one, Bearer prefix included — the opposite of n8n's Bearer Auth credential. Dify picks the transport from the last path segment of the URL: mcp means Streamable HTTP, sse means SSE, anything else means SSE first with a fallback. So /v1/mcp hits the fast path, and /v1/mcp/ is fine too. The Server Identifier is load-bearing: change it later and every app that referenced it breaks. Per-caller passthrough with {{request.headers.Authorization}} sends the literal placeholder on scheduled and internal runs, so use the static token.
Check it worked
Ask the agent to text you. A 401 means the token is wrong, or the word Bearer is in there twice. No tool at all means the transport string is wrong. Both are covered in troubleshooting.
Next
The five tools and their arguments are on the MCP page. The same tools over plain HTTP are on the REST page. Every other tool is on the docs index.