MCP (Model Context Protocol) has established itself as the universal way to connect LLMs (Large Language Models) and other AI systems with data sources.

Through our MCP server, AI systems can access process data managed in Stages for various purposes and use cases.

In the currently provided MCP solution Stages provides access to a valid versions of workspaces only.

The Stages MCP server grants access to the valid versions of all workspaces the authenticated user has access to and for which the “MCP” permission is granted.

Currently it offers 10 tools to browse and search workspaces and elements. This is subject to change.

The Stages MCP server is integrated into Stages 26.2.0.0 and later.

Note: Stages 7.12.5.1 or later and Stages 26.1.0.0 or later had a beta implementation of this feature that worked quite differently.

Currently authentication is only available via external IdP like Entra ID or Keycloak.

To enable MCP add a resource configuration to your IdP. Typically a App or Client registration. If you already use OIDC you can use this configuration.

On this client add a custom scope, you can find this in “Expose an API” or “Client scopes”. In Entra ID you have to specify the Application ID URI. You have to use this format:

https://stages.example.com/stages/api/1/mcp

Use this as clientId TODO in configuration. In other systems it is the clientId of the application. Stages checks this value as audience claim.

Now add this to your <authentication> section in config.xml:

<method type="JWT" name="myIdp">
    <properties>
        <property name="discoveryURI" value="${idp.myIdp.oidc.discovery.url}" />
        <property name="clientId" value="${idp.myIdp.oidc.audience}" /> <!-- TODO -->
        <property name="customParams.usernameAttribute" value="upn" /> <!-- TODO -->
    </properties>
    <filters>
        <attribute-match id="*" pattern="*" defaultUserGroupsUsername="${user.default.username}"
            defaultLicenseType="${user.default.licenseType}" autocreateUser="${saml.autocreate}" />
    </filters>
</method>

• discoveryURI: The link to your .well-known/openid-configuration file. For Entra Id e.g. it is https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration
• clientId: TODO The audience Stages (as resource server) has to check in JWT.
• customParams.usernameAttribute: TODO Where in JWT the username can be found. Typically the mail address.
• Configure filter like in SAML / OIDC configuration TODO

The MCP integration acts in the name of the user. The user needs MCP permission in addition to normal permission to view the workspaces and process elements via MCP. Add MCP Domain to default group if you want to enable all users to use MCP.

Direct your MCP client to this URL to access Stages MCP server:

https://stages.example.com/stages/api/1/mcp

Currently we're supporting Streamable HTTP.