Differences

This shows you the differences between two versions of the page.

--- 262:mcpserver [2026/10/27 09:13] – Policnik, Florian
+++ 262:mcpserver [2026/10/28 10:46] (current) – Policnik, Florian
@@ Line 5: / Line 5: @@
 Through our MCP server, AI systems can access process data managed in Stages for various purposes and use cases.
-In the currently provided MCP solution Stages provides access to a **valid versions of workspaces only**.
+In the currently provided MCP solution Stages provides access to **valid versions of workspaces only**.
 ===== What it offers =====
@@ Line 21: / Line 21: @@
 ===== Configuration =====
-Currently authentication is only available via external IdP like Entra ID or Keycloak.
+Authentication is currently available only through an external identity provider (IdP), such as Microsoft Entra ID or Keycloak.
-==== IdP Configuration ====
+==== IdP configuration ====
-To enable MCP add a resource configuration to your IdP. Typically a App or Client registration. If you already use OIDC you can use this configuration.
+To enable MCP, add a resource configuration to your IdP, typically by creating an app or client registration. If you already use OIDC, you can use that configuration.
-On this client add a custom scope, you can find this in "Expose an API" or "Client scopes". In Entra ID you have to specify the Application ID URI. You have to use this format:
+Add the custom scope to the client:
+''stages:mcp:read''
+Depending on your IdP, you may find this under "Expose an API" or "Client scopes". In Microsoft Entra ID, specify the Application ID URI using this format:
 ''<nowiki>https://stages.example.com/stages/api/1/mcp</nowiki>''
-Use this as ''clientId'' TODO in configuration. In other systems it is the clientId of the application. Stages checks this value as audience claim.
+Use this value as the audience in the configuration. In other systems, the audience may be the application's client ID. Stages checks this value against the JWT's audience claim.
+==== Stages configuration ====
-==== Stages Configuration ====
+Add the following to the ''<authentication>'' section in ''config.xml'':
-Now add this to your ''<authentication>'' section in config.xml:
 <code xml>
@@ Line 42: / Line 45: @@
     <properties>
         <property name="discoveryURI" value="${idp.myIdp.oidc.discovery.url}" />
-        <property name="clientId" value="${idp.myIdp.oidc.audience}" /> <!-- TODO -->
+        <property name="audience" value="${idp.myIdp.oidc.audience}" />
-        <property name="customParams.usernameAttribute" value="upn" /> <!-- TODO -->
+        <property name="usernameAttribute" value="upn" />
     </properties>
     <filters>
@@ Line 52: / Line 55: @@
 </code>
-  * ''discoveryURI'': The link to your ''.well-known/openid-configuration'' file. For Entra Id e.g. it is ''https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration''
+  * ''discoveryURI'': The URL of the IdP's ''.well-known/openid-configuration'' file. For example, in Microsoft Entra ID: ''https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration''.
-  * ''clientId'': TODO The audience Stages (as resource server) has to check in JWT.
+  * ''audience'': The audience value that Stages, as the resource server, checks in the JWT.
-  * ''customParams.usernameAttribute'': TODO Where in JWT the username can be found. Typically the mail address.
+  * ''usernameAttribute'': The JWT claim containing the username. This is typically the user's email address.
-  * Configure filter like in SAML / OIDC configuration TODO
+  * Configure the filter as you would for [[.:integration:oidc|OIDC]] authentication.
 ==== Stages permissions ====
-The MCP integration acts in the name of the user. The user needs MCP permission in addition to normal permission to view the workspaces and process elements via MCP. Add MCP Domain to default group if you want to enable all users to use MCP.
+The MCP integration acts on behalf of the authenticated user. In addition to the usual permissions to view workspaces and process elements, the user must have the MCP permission to access them through MCP.
+To let all users use MCP, add the MCP domain to the default group.
 ==== MCP client configuration ====
-Direct your MCP client to this URL to access Stages MCP server:
+Configure your MCP client to connect to the Stages MCP server at this URL:
 ''<nowiki>https://stages.example.com/stages/api/1/mcp</nowiki>''
-Currently we're supporting Streamable HTTP.
+Stages currently supports Streamable HTTP.