Configuration

MCP Server Configuration

By default, the MCP server is disabled. To enable it and make further configurations, open base/classes/config/environment_settings.xml and navigate to the mcp group.

Here you can enable the MCP server. Additionally, security is enabled by default and must be configured separately. This will be covered later.

disable.tools can be used to explicitly exclude specific tools from being exposed. These will not appear in the list of available tools.

MCP Server Security

Orchestra supports two authentication methods for the MCP server: OAuth 2.1 (recommended for production) and Password (for development and testing only).

OAuth 2.1

To use OAuth 2.1, an identity provider that implements OAuth 2.1 Client Authentication is required.

Once configured, the following properties can be set in environment_settings.xml within the oauth group:

• authflow.authorization.server
• verify.plainAuthenticationServerUrl

For a description of each parameter, please refer to the property descriptions within the file itself.

Additionally, a role mapping must be configured in base/classes/config/security_settings.xml. Add a group here with the name of the role as defined in your identity provider. This is required to map the roles from the identity provider to Orchestra roles.

<group name="mcp-user" description="A full MCP access">
  <isMemberOf>MCP</isMemberOf>
</group>

Password Authentication

As an alternative to OAuth 2.1, you can configure Basic Authentication using a username and password. Set security.authentication.type to Password in environment_settings.xml:

<parameter name="security.authentication.type" value="Password" type="CHOICE:OAuth,Password"/>

warning

Password Authentication is not suitable for production environments, as credentials must be stored in plain text in the MCP client configuration. Use OAuth 2.1 for production deployments.

MCP Client

To connect to the MCP server, add the following to your MCP client's server configuration.

import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem';

{
  "mcpServer": {
    "solution-hub-mcp-server": {
      "type": "streamable-http",
      "url": "https://localhost:8473/sh-api/ai/mcp"
    }
  }
}

With OAuth 2.1, the client handles token acquisition automatically. No headers need to be configured manually.

{
  "mcpServer": {
    "solution-hub-mcp-server": {
      "type": "streamable-http",
      "url": "https://localhost:8473/sh-api/ai/mcp",
      "headers": {
        "Authorization": "Basic <base64-credentials>"
      }
    }
  }
}

Replace <base64-credentials> with a Base64-encoded string of your credentials in the format username:password:

echo -n "username:password" | base64