MCP (Model Context Protocol) has established itself as the universal way to connect LLMs (Large Language Models) and other AI systems with data sources.

Through our MCP server, AI systems can access process data managed in Stages for various purposes and use cases.

In the currently provided MCP solution Stages provides access to a valid versions of workspaces only.

The Stages MCP server grants access to the valid versions of all workspaces the authenticated user has access to and for which the “MCP” permission is granted.

Currently it offers 10 tools to browse and search workspaces and elements. This is subject to change.

The Stages MCP server is integrated into Stages 26.2.0.0 and later.

Note: Stages 7.12.5.1 or later and Stages 26.1.0.0 or later had a beta implementation of this feature that worked quite differently.

Currently authentication is only available via external IdP like Entra ID or Keycloak. To enable MCP add a resource configuration to your IdP and add this to your <authentication> section in config.xml:

<method type="JWT" name="myIdp">
    <properties>
        <property name="discoveryURI" value="${idp.myIdp.oidc.discovery.url}" />
        <property name="clientId" value="${idp.myIdp.oidc.audience}" /> <!-- TODO -->
        <property name="customParams.usernameAttribute" value="upn" /> <!-- TODO -->
    </properties>
    <filters>
        <attribute-match id="*" pattern="*" defaultUserGroupsUsername="${user.default.username}"
            defaultLicenseType="${user.default.licenseType}" autocreateUser="${saml.autocreate}" />
    </filters>
</method>

• discoveryURI: The link to your .well-known/openid-configuration file. For Entra Id e.g. it is https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration
• clientId: TODO The audience Stages (as resource server) has to check in JWT.
• customParams.usernameAttribute: TODO Where in JWT the username can be found. Typically the mail address.
• Configure filter like in SAML / OIDC configuration TODO