MCP (Model Context Protocol) has established itself as the universal way to connect LLMs (Large Language Models) and other AI systems with data sources.

Through our MCP server, AI systems can access process data managed in Stages for various purposes and use cases.

In the currently provided MCP solution Stages provides access to valid versions of workspaces only.

The Stages MCP server grants access to the valid versions of all workspaces the authenticated user has access to and for which the “MCP” permission is granted.

Currently it offers 10 tools to browse and search workspaces and elements. This is subject to change.

The Stages MCP server is integrated into Stages 26.2.0.0 and later.

Note: Stages 7.12.5.1 or later and Stages 26.1.0.0 or later had a beta implementation of this feature that worked quite differently.

Authentication is currently available only through an external identity provider (IdP), such as Microsoft Entra ID or Keycloak.

To enable MCP, add a resource configuration to your IdP, typically by creating an app or client registration. If you already use OIDC, you can use that configuration.

Add the custom scope to the client:

stages:mcp:read

Depending on your IdP, you may find this under “Expose an API” or “Client scopes”. In Microsoft Entra ID, specify the Application ID URI using this format:

https://stages.example.com/stages/api/1/mcp

Use this value as the audience in the configuration. In other systems, the audience may be the application's client ID. Stages checks this value against the JWT's audience claim.

Add the following to the <authentication> section in config.xml:

<method type="JWT" name="myIdp">
    <properties>
        <property name="discoveryURI" value="${idp.myIdp.oidc.discovery.url}" />
        <property name="audience" value="${idp.myIdp.oidc.audience}" />
        <property name="usernameAttribute" value="upn" />
    </properties>
    <filters>
        <attribute-match id="*" pattern="*" defaultUserGroupsUsername="${user.default.username}"
            defaultLicenseType="${user.default.licenseType}" autocreateUser="${saml.autocreate}" />
    </filters>
</method>

• discoveryURI: The URL of the IdP's .well-known/openid-configuration file. For example, in Microsoft Entra ID: https://login.microsoftonline.com/<tenantId>/v2.0/.well-known/openid-configuration.
• audience: The audience value that Stages, as the resource server, checks in the JWT.
• usernameAttribute: The JWT claim containing the username. This is typically the user's email address.
• Configure the filter as you would for SAML or OIDC authentication. TODO

The MCP integration acts on behalf of the authenticated user. In addition to the usual permissions to view workspaces and process elements, the user must have the MCP permission to access them through MCP.

To let all users use MCP, add the MCP domain to the default group.

Configure your MCP client to connect to the Stages MCP server at this URL:

https://stages.example.com/stages/api/1/mcp

Stages currently supports Streamable HTTP.