Configuration

MCP Server Configuration

By default, the MCP server is disabled. To enable it and make further configurations, open base/classes/config/environment_settings.xml and navigate to the mcp group.

Here you can enable the MCP server. Additionally, security is enabled by default and must be configured separately. This will be covered later.

disable.tools can be used to explicitly exclude specific tools from being exposed. These will not appear in the list of available tools.

excluded.patch.scenario.elements can be used to exclude specific scenario elements from the patch_scenario_element tool, in case they cause frequent errors or if exposing them is not desired.

MCP Server Security

To enable the security of the MCP server, an identity provider that implements OAuth 2.1 Client Authentication is required.

Once configured, the following properties can be set in environment_settings.xml within the oauth group:

• authflow.authorization.server
• verify.plainAuthenticationServerUrl

For a description of each parameter, please refer to the property descriptions within the file itself.

Additionally, a role mapping must be configured in base/classes/config/security_settings.xml. Add a group here with the name of the role as defined in your identity provider. This is required to map the roles from the identity provider to Orchestra roles.

<group name="mcp-user" description="A full MCP access">
  <isMemberOf>MCP</isMemberOf>
</group>

MCP Client

In order to connect to the MCP server, configure your MCP client by adding the following to its MCP server configuration.

{
  "mcpServers": {
    "orchestra-designer": {
      "type": "streamable-http",
      "url": "https://localhost:8453/designer/ai/mcp",
    }
  }
}