Model Context Protocol (MCP)

An MCP provider is a service or application that exposes functions or data via the Model Context Protocol (MCP), enabling AI models such as ChatGPT to access and interact with them.

The following section explains all necessary steps to configure the MPC server.

Open Admin > External Services > Registered MCP Servers and create or edit a server record.

Use the following fields:

Field	Value or explanation
Name	A meaningful label, for example DataEngine MCP.
Server URL	The MCP endpoint, for example https://mcp.example.com/_mcp.
Transport	Streamable HTTP.
Status	Active.
Auth Mode	Select the authentication method required by the server.
Auth Reference	Select the matching External OAuth Connection.

The available authentication modes are:

• None: The MCP endpoint is public and does not require a bearer token.
• Bearer Ref: Reuses an existing user or bearer-token External OAuth Connection.
• OAuth Client Credentials Ref: Uses a service-token connection. This is the usual choice for the DataEngine mcp-server deployment.

The Auth Reference list is filtered automatically. Bearer Ref shows connections whose provider is not configured for client_credentials. configured for client_credentials.

Click Save, open the record’s detail view, and select Run Probe. A successful probe discovers the tools offered by the server. The administrator then uses the compatibility matrix to approve the tools that workflow users may select.

There are two distinct OAuth client roles. Make sure you keep them separate and configure each according to its specific purpose.

Incoming client: user or agent to the MCP server

This client is used when a browser or agent authenticates against the MCP server. The usual flow is authorization code with PKCE:

• Flow type: authorization_code
• Code challenge: S256
• DataEngine OAuth2 grant: authorization_code
• Token request grant: authorization_code
• Refresh request grant: refresh_token

For this flow, the MCP authorization metadata normally supports code and S256. The browser client does not need to send a client secret. The MCP server’s BFF proxy supplies its configured secret when it calls DataEngine.

Outgoing client: MCP server to DataEngine

The MCP server uses this service client when it calls DataEngine, for example to validate a token or to request the current user. Configure it as follows:

• DataEngine OAuth2 grant: client_credentials
• Token request grant: client_credentials
• Refresh request grant: client_credentials

This outgoing client is required for the DataEngine mcp-server deployment. Third-party MCP servers may use a different authentication design.

If you need help or advice setting up your MCP server, just contact us. We will be happy to help you!