The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Connect IBM Bob to an internal service by configuring a vetted Model Context Protocol (MCP) server that exposes only the tools or resources Bob needs. Bob does not include pre-installed MCP servers, so your organization must select or build the integration and control its permissions. If you also need to control where Bob’s backend runs, consider IBM Bob self-hosted on customer-managed Red Hat OpenShift; that is a separate deployment choice, not an MCP setting.
Choose the right connection approach
MCP is the documented extension point for connecting Bob to capabilities provided by an external server. It is not a universal connector that automatically grants safe access to databases, repositories, or other private systems. Your organization decides what the server exposes and which credentials and permissions it uses.
As an Amazon Associate I earn from qualifying purchases.
| Decision | SaaS Bob | Self-hosted Bob |
|---|---|---|
| Infrastructure owner | IBM hosts and manages the service. | The customer manages Bob on OpenShift. |
| Operations | IBM handles upgrades, scaling, and availability. | The customer owns lifecycle operations. |
| Security controls | IBM-managed. | The customer configures networking, storage, and identity. |
| Data residency | IBM-managed regions. | The customer controls placement within its environment. |
| Best fit | Teams that want a managed service and do not require the backend inside their infrastructure. | Organizations with data-residency, network-boundary, or disconnected-environment requirements and the capacity to operate OpenShift. |
The comparison reflects IBM’s self-hosted overview; the best-fit guidance follows from the stated operating responsibilities.
Connect an internal service through MCP
1. Define the narrow use case
Start with the task Bob needs to perform and the smallest set of data and actions required. Avoid giving an integration broad database, repository, or command access when a limited set of tools will do.
#1 Best Overall
2. Select or build an MCP server
IBM says Bob does not include pre-installed MCP servers. Your organization must build a server or choose one from the MCP ecosystem, then review its code, documentation, permissions, and data handling before use. IBM’s MCP guide recommends checking server behavior and testing it in isolation.
3. Configure authentication and transport
Set up the credentials and network path the server requires. For enterprise use, require authentication, encryption in transit, scoped access controls, and audit logs. For shared servers, make sure actions can be attributed to an individual user or session.
Rank #2
- DISCLOSURE - Brand New Computer has been resealed to upgrade Memory/SSD. 1 Year warranty by Issaquash Highlands Tech
- ENTERPRISE-READY PERFORMANCE - Built for business professionals and SMBs who want more than the E16 or ThinkBook 16 without stretching to the T16, the ThinkPad L16 delivers dependable performance, durable design, and exceptional value for everyday productivity. Engineered for reliability, it is MIL-STD-810H certified to withstand demanding fieldwork and travel. Delivers up to 10 hours of battery life with fast charging (80% in 1 hour), keeping you productive on the go
- POWERFUL PERFORMANCE - Powered by an Intel Core Ultra 5 225U Processor (12 cores, up to 4.8 GHz) and integrated Intel Graphics, the AI PC delivers power-efficient performance for demanding workloads. Configurable with memory options from 8GB to 64GB DDR5 RAM and storage options from 256GB to 2TB M.2 NVMe PCIe SSD, enabling smooth multitasking and fast loading across a wide range of applications
- CRISP DISPLAY - Features a 16" WUXGA (1920×1200) IPS display with a high-brightness 400-nit anti-glare screen, ensuring peak productivity even in sunlit offices or cafes, eliminating the washed-out look typical of standard business laptops. Supports up to 3 external displays via HDMI (max 4K@60Hz) or Thunderbolt 4 (max 8K@60Hz), enabling flexible multi-screen productivity for data analysis without a docking station. A 720p webcam with privacy shutter ensures clear video conferencing and security
- ADVANCED CONNECTIVITY - Equipped with 2x Thunderbolt 4, 2x USB-A 3.2 Gen 1, USB-A 2.0, HDMI 2.1, Ethernet (RJ-45), and a headphone/mic for flexible connectivity. Features Wi-Fi 6E and Bluetooth 5.3 for ultra-fast, stable wireless. Enhanced with a fingerprint reader, backlit keyboard, and a dedicated numeric keypad for secure, efficient typing in any environment
4. Register it at the right scope
Bob supports global MCP configuration at ~/.bob/settings/mcp.json and project configuration at .bob/mcp.json. A project file can be shared through version control. Project-level settings take precedence when server names conflict. Use the appropriate scope for the team and project, and follow IBM’s current MCP configuration instructions for the required JSON fields and transport-specific settings.
5. Disable tools you do not need and test safely
Bob provides controls to enable or disable servers and individual tools. Turn off unused capabilities, then test the integration in an isolated, non-production environment. Monitor its behavior before authorizing production use.
Reduce exposure from files, commands, and MCP tools
- Restrict workspace files: Use
.bobignoreto limit files Bob can read or modify. Keep secrets out of prompts, snippets, and accessible files; IBM recommends excluding secret files from both.gitignoreand.bobignore. - Limit automatic actions: IBM classifies automatic file edits and command execution as high-risk settings. Restrict auto-approval and avoid broad command patterns.
- Assess where data goes: External MCP servers may send data to third parties or store or log it. Prefer a local server for confidential projects when it suits the architecture, but do not assume local means safe: a local server runs with Bob’s permissions and may access files, environment variables, and other system resources.
- Maintain oversight: Keep an approved-server list, review and test server changes in isolation, and monitor for unexpected network activity or file access. In regulated or restricted environments, involve the security team.
These precautions follow IBM’s security guidance for Bob and MCP. The exact server, permissions, identity mapping, and network rules depend on the target system and your enterprise architecture.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to choose IBM Bob self-hosted
Self-hosted Bob is a separate way to control the backend environment. IBM describes it as a self-managed Bob backend running on customer-managed Red Hat OpenShift Container Platform. The customer manages backend infrastructure, services, integrations, lifecycle operations, networking, storage, identity, and platform security logs. A dedicated cluster is not required if a shared OpenShift cluster has adequate resources.
Connect a client to the deployment
For a Bob IDE client or Bob Shell, the deployment administrator supplies the API endpoint, normally https://api.<cluster-domain>, and configures user authentication. A workstation must trust the deployment certificate if it is self-signed or issued by an internal certificate authority. IBM’s access instructions describe LDAP or Active Directory federation, or a direct Keycloak account, as identity options. Use the deployment documentation for the exact setup for your environment.
Understand model routing and disconnected deployments
In its release post dated September 24, 2026, IBM said Bob self-hosted became generally available. IBM described two model routes: using a frontier model through the organization’s cloud account, or running supported open-weight models on the organization’s GPUs. In the cloud-account route, IBM says the backend, identity, audit logs, and metering stay on the customer cluster, while model requests and their carried code context go to the organization’s cloud model account. For networks without outbound connectivity, IBM described the local-GPU route and support for fully air-gapped clusters. These are IBM’s release descriptions; confirm supported configurations and prerequisites in the deployment documentation before choosing a route. See IBM’s September 2026 release post.
Plan for platform-level logging
Self-hosting does not remove the need to configure operations and audit controls. IBM says security event logging and monitoring for Bob self-hosted are managed at the OpenShift platform level and are not provided by Bob. Your organization must configure and retain platform logs to meet its audit requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
