Skip to main content

How to Expose the Tenant over MCP

Let Claude Code, Cursor, VS Code, Copilot Studio or another MCP client search and use the tenant's knowledge. You publish a bundle of tools as an MCP server setup; each person connects with their own sign-in or API key, and document access rights apply as in the Navigator.

1. Create an MCP server setup​

  1. Open Tenants → <tenant>. On the MCP Server Setups card, click Create MCP Server Setup.
  2. Enter an Identifier, for example research. Clients address the setup by it.
  3. In Configuration, list the tools to expose. The blocks are the ones agents use, see Configuration: mcp_server_setups.
  4. Click Create MCP Server Setup.

2. Register an OAuth client​

Skip this step when people connect with an API key, or when the tenant does not sign in with OIDC: OAuth clients need the tenant's SSO.

  1. On the OAuth clients card, click Create OAuth client.
  2. Enter a Name and pick the Type:
    • Desktop app for applications on users' machines: Claude Code, Cursor, VS Code, MCP Inspector, and claude.ai connectors.
    • Web app for applications with their own backend: Copilot Studio, Bedrock AgentCore, Gemini Enterprise, another Zeta Alpha agent. Enter its Redirect URLs, comma-separated.
  3. Click Create. The client's page shows its client ID, the secret for a web app, and the endpoints.

3. Hand out the connection details​

Open the setup from the MCP Server Setups card. Connect shows its MCP URL and, for the chosen authentication (API key or an OAuth client), a ready-to-paste snippet for a Zeta Alpha agent, Claude Code, Cursor, VS Code, Codex, or any other client.

What users see​

With OAuth, the client opens the tenant's sign-in page in the browser, and tools run as the signed-in user. With an API key, tools run as the key's user, see Generating API keys.

Pitfalls​

  • Not every client can use OAuth; what Codex and ChatGPT connectors support is in Authentication.
  • Deleting an OAuth client stops the connections that use it once their tokens expire. Deleting a setup breaks every client that addresses it.

Endpoint, authentication and configuration details are in MCP Server.