Skip to main content
Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
This page walks through registering an MCP server with C1, linking it to a C1 application, and configuring authentication. Once registered, C1 discovers the tools and resources the server exposes. See Govern tools and toolsets and Govern MCP resources for what to do next.

​
Before you begin

  • AIAM must be enabled for the tenant. See Enable AI access management.
  • For OAuth-based auth, you’ll need a client ID and secret from the downstream service — unless the server supports OAuth Dynamic Client Registration (DCR), in which case C1 registers itself automatically and no credentials are required.
  • For per-user OAuth, the downstream service must be reachable by C1’s hosted callback URL.

​
Register an MCP server

C1 walks you through registering an MCP server one question at a time, whether you start from the catalog or from a custom URL:
1
In C1, go to AI > MCP and click Connect MCP server.
2
Choose the server from the catalog shortlist (or browse the full catalog grid), or enter a custom URL.
3
Answer the setup questions as they appear: where the server is hosted (public or through a bridge), the server URL, who should be able to use it and when, and what happens to newly discovered tools.
4
Confirm authentication. C1 probes the server’s OAuth configuration automatically — a self-registering (DCR) server asks nothing further here. Otherwise, choose an auth method; see Configure authentication for what each one needs.
5
Review and submit. C1 registers the server and runs initial discovery.
Access profile selection isn’t applied yet. The guided flow lets you choose an access profile during setup, but that selection currently isn’t bound to the server at registration — it’s recorded but not enforced. Assign an access profile afterward from the server’s settings, or through Govern tools and toolsets, rather than relying on the in-flow selection.
After registration, the server appears in AI > MCP. Its discovered tools are listed on the Tools tab. If the server exposes resources, they are listed on the Resources tab. You can sort the Tools tab by tool name, visibility, classification, state, and last updated.
The server’s URL can’t be changed once it completes its first successful sync. To point at a different endpoint, register a new MCP server instead.

​
Configure authentication

C1 supports multiple auth methods for downstream MCP servers. Admins can select any supported method when configuring a server. For per-user OAuth passthrough, C1 vaults each user’s downstream tokens and auto-refreshes them so end users don’t hit token expiry mid-session. To configure auth:
1
From the registered server’s settings, click Edit authentication.
2
Select the auth method.
3
Enter the required credentials for the selected method:
  • Bearer token — paste the token. C1 vaults it.
  • Custom header — enter the header name and value.
  • Basic auth — choose a credential mode:
    • Shared (admin authorizes): Enter a username and password once. All users connect using the same credentials.
    • Per-user (each user submits their own): No credentials to enter. Each user provides their own username and password when they connect, and MCP requests run under their individual identity.
  • Client credentials — enter client ID, client secret, and token URL.
  • Service mode — enter client ID, client secret, authorization URL, token URL, and scopes. An admin completes the OAuth flow once; all users share that credential.
  • Per-user passthrough — enter client ID, client secret, authorization URL, token URL, and scopes. End users see a Connect prompt the first time their AI client calls a tool from this server.
  • JWT bearer — enter the issuer, private key, subject, audience, token URL, and scopes.
If the server supports OAuth Dynamic Client Registration (DCR), you can skip entering a client ID and secret entirely. Toggle on Use dynamic client registration — C1 registers itself with the server’s authorization server automatically.Before registering, C1 runs a discovery check against the server’s authorization server. If discovery finds an issue that can be relaxed — such as an issuer mismatch or an authorization server on a different host — C1 shows you the finding and asks you to acknowledge it before registration continues. Findings that can’t be safely relaxed block registration entirely.
4
Click Save. C1 makes a test call to validate the credentials.

​
Configure server settings

​
What happens after registration

  • C1 runs an initial tool and resource discovery sweep against the server. Discovered tools appear under the Tools tab with state Pending Review by default. Discovered resources and URI templates appear on the Resources tab with state Pending.
  • C1 re-runs discovery on a schedule. New tools and resources need review. Tools that disappear are flagged but not auto-deleted. Resources that disappear are marked Removed and cannot be read.
  • No tool from this server is callable by any end user yet — see Govern tools and toolsets to approve, classify, and bundle them. A resource also needs approval and a user grant before it can be read. See Govern MCP resources.