Two Long Forms Became Two Wizards

September 2, 2026 · InfraScout Team

Registering an MCP server meant one long scrolling column showing every field of every transport at once: identity, transport, a URL or an agent runtime, command, arguments, environment variables, headers, authentication, discovery timeout and the usage guide. All stacked, and it was your job to work out which half applied to you.

The Entra connection form had grown the same way. Both are now wizards, sharing one shell.

MCP server: five steps

Identity · Connection · Authentication · AI Guidance · Review. You see only the fields your chosen transport actually uses, and the Review step lists what you are about to save with an Edit link back to each step.

Two behaviors are worth knowing, since they might otherwise read as faults:

Test connection is available when editing, not when creating. There is nothing to probe before the record exists, and the test checks the saved configuration rather than your unsaved edits. Create mode says so rather than offering a button that cannot work. For an agent-hosted server the test confirms the agent is online and its child reported running recently, rather than making a network call.

The OAuth redirect URI is read-only by design. InfraScout issues that address and you copy it out, into your provider's app registration. It now renders as a value rather than as an input, and where the OAuth bridge is unreachable it says so with a Retry instead of presenting an empty box.

Entra connection: four steps, or three

Identity · Credentials · Sync & Scope · Review. An assessment connection neither syncs nor scopes, so the Sync & Scope step is dropped rather than rendered empty — the wizard is three steps for that type, and the stepper adapts the moment you choose.

The point of the exercise is one gate. A filter you have typed but not tested has always had to pass its test before the connection could be saved — and that requirement used to express itself by disabling the Save button several screens away from the filter, with nothing explaining why. As a step gate it can say why, on the field, before you ever reach Review.

Saving from any step now takes you to the step holding the problem, rather than showing a message about a field you cannot see.

Both forms save exactly what they saved before, including the filter clearing behavior on a type change and the blank-secret handling that preserves a stored secret you did not retype. The Review step never displays a secret: it reads Not set, Set, or Unchanged.

Keyboard and screen-reader access

Restructuring the forms was also the opportunity to fix how they are navigated without a mouse. The type and transport selection cards are now properly reachable and grouped, so arrow keys move within a group rather than between two unrelated ones; the step indicators are described as the step group they are rather than as tabs they never implemented; the collapsible sections carry accessible names; and a step change is announced.

One thing deliberately left loose

A stricter naming rule for a server's internal identifier was proposed — lowercase, digits, hyphens and underscores only. The platform is looser than that: it rejects only a double underscore, which is the separator used to route a tool to its server.

Enforcing the stricter rule in the form would have been a new client-side constraint capable of rejecting records that already exist. So the form mirrors the platform — required, no double underscore, turning a guaranteed failure into an inline message — and keeps "lowercase, no spaces" as guidance rather than as a gate.

Discovery health, and a per-server timeout

Shipped alongside, and the most consequential item here if you run remote MCP servers.

A registered server has to be asked what tools it offers before those tools can appear in chat. That handshake is separate from an ordinary tool call, and it ran on a fixed ten-second budget for every server alike — which is not always enough. A real remote server can take longer than that to complete a handshake while answering ordinary tool calls in a fraction of a second, because those get a much longer budget.

So the discovery timeout is now per server, settable between 20 and 60 seconds. Leave it alone unless a specific server needs more.

More importantly, the card now tells you the truth. A remote server whose discovery is failing shows a red status dot, the category of failure, and how long it has been failing — where previously every enabled server painted green regardless of whether InfraScout had reached it since the day it was registered.

That mattered more than a wrong color. A server whose discovery never succeeds keeps serving its last known tool list, including the read-only declarations that feed the read-only role gate, and nothing indicated how old that list was. Test connection and Refresh tools now clear the failure state on success, so the manual remedy does something visible.

The recorded error is a category rather than the underlying message, deliberately: that message can carry the server's URL and query string, and on a credential failure the internals of the secret store, and it would be one click from an administrator's clipboard. Contact us where the category is not enough to act on.

See MCP Servers and Connecting Entra ID.

Questions or feedback? Reach us at info@infrascout.cloud.