Skip to main content
Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
This page walks through adding an MCP source to C1, linking it to a C1 application, and configuring authentication. Once added, C1 discovers the tools and resources the source exposes. See Govern tools and toolsets and Govern MCP resources for what to do next.

​
Before you begin

  • AIAM must be enabled for the tenant. See Enable AI access management.
  • For OAuth-based auth, you’ll need a client ID and secret from the downstream service — unless the source’s MCP server supports OAuth Dynamic Client Registration (DCR), in which case C1 registers itself automatically and no credentials are required.
  • For per-user OAuth, the downstream service must be reachable by C1’s hosted callback URL.

​
Add an MCP source

C1 walks you through adding an MCP source one question at a time, whether you choose a source from the catalog or provide an external URL:
1
In C1, go to AI > MCP Sources and click Add MCP source.
2
Choose a Catalog MCP source from the shortlist or browse all available sources, or add an External MCP source using a custom URL.
3
Answer the setup questions as they appear: where the source’s MCP server is hosted (public or through a bridge), the server URL, who should be able to use it and when, and what happens to newly discovered tools.
4
Confirm authentication. C1 probes the MCP server’s OAuth configuration automatically — a self-registering (DCR) server asks nothing further here. Otherwise, choose an auth method; see Configure authentication for what each one needs.
5
Review and submit. C1 adds the source and runs initial discovery.
Access profile selection isn’t applied yet. The guided flow lets you choose an access profile during setup, but that selection currently isn’t bound to the source — it’s recorded but not enforced. Assign an access profile afterward from the source’s settings, or through Govern tools and toolsets, rather than relying on the in-flow selection.
After setup, the source appears in AI > MCP Sources. Its discovered tools are listed on the Tools tab. If the source exposes resources, they are listed on the Resources tab. You can sort the Tools tab by tool name, visibility, classification, state, and last updated.
The source’s URL can’t be changed once it completes its first successful sync. To point at a different endpoint, add a new MCP source instead.

​
Configure authentication

C1 supports multiple auth methods for downstream MCP servers. Admins can select any supported method when configuring a source. For per-user OAuth passthrough, C1 vaults each user’s downstream tokens and auto-refreshes them so end users don’t hit token expiry mid-session. To configure auth:
1
From the MCP source’s settings, click Edit authentication.
2
Select the auth method.
3
Enter the required credentials for the selected method:
  • Bearer token — paste the token. C1 vaults it.
  • Custom header — enter the header name and value.
  • Basic auth — choose a credential mode:
    • Shared (admin authorizes): Enter a username and password once. All users connect using the same credentials.
    • Per-user (each user submits their own): No credentials to enter. Each user provides their own username and password when they connect, and MCP requests run under their individual identity.
  • Client credentials — enter client ID, client secret, and token URL.
  • Service mode — enter client ID, client secret, authorization URL, token URL, and scopes. An admin completes the OAuth flow once; all users share that credential.
  • Per-user passthrough — enter client ID, client secret, authorization URL, token URL, and scopes. End users see a Connect prompt the first time their AI client calls a tool from this source.
  • JWT bearer — enter the issuer, private key, subject, audience, token URL, and scopes.
If the source’s MCP server supports OAuth Dynamic Client Registration (DCR), you can skip entering a client ID and secret entirely. Toggle on Use dynamic client registration — C1 registers itself with the server’s authorization server automatically.Before adding the source, C1 runs a discovery check against the server’s authorization server. If discovery finds an issue that can be relaxed — such as an issuer mismatch or an authorization server on a different host — C1 shows you the finding and asks you to acknowledge it before setup continues. Findings that can’t be safely relaxed block setup entirely.
4
Click Save. C1 makes a test call to validate the credentials.

​
Configure source settings

​
What happens after setup

  • C1 runs an initial tool and resource discovery sweep against the source. Discovered tools appear under the Tools tab with state Pending Review by default. Discovered resources and URI templates appear on the Resources tab with state Pending.
  • C1 re-runs discovery on a schedule. New tools and resources need review. Tools that disappear are flagged but not auto-deleted. Resources that disappear are marked Removed and cannot be read.
  • No tool from this source is callable by any end user yet — see Govern tools and toolsets to approve, classify, and bundle them. A resource also needs approval and a user grant before it can be read. See Govern MCP resources.