Build with AI

Getting started

The AIC Remote MCP Server is currently available in Rapid (Sandbox) environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks.

For more information on how to have the AIC Remote MCP Server enabled, refer to Overview.

Connect a supported AI client to the AIC Remote MCP Server.

Prerequisites

Before you configure a client, make sure you have:

  • A PingOne Advanced Identity Cloud tenant with the AIC Remote MCP Server enabled.

  • An MCP-compatible client. This page provides step-by-step configuration for Claude Code, VS Code with GitHub Copilot, OpenAI Codex CLI, and Cursor. If your client isn’t listed, use the General JSON tab below and adapt it.

Server details

Use these values in every client configuration below:

Field Value

Server URL

https://openam-<your-tenant>.forgeblocks.com/mcp (substitute <your-tenant> with your tenant hostname prefix)

OAuth client ID

AICRemoteMCPClient (public client, authorization code with PKCE, no secret)

Only the default AM FQDN (openam-<your-tenant>.forgeblocks.com) is supported as the server URL. Custom domain aliases are not supported and will result in a CORS error.

Some MCP clients let you specify the OAuth redirect URI instead of using a fixed value. If your client provides this option, use a loopback URI such as http://localhost:3000, and make sure the client listens on that address for the OAuth callback. Use the exact same URI in the form-action directive if your tenant enforces a Content Security Policy (CSP).

Clients that support RFC 9728 Protected Resource Metadata discover the authorization server and required scopes automatically. Clients that don’t must list them explicitly. Refer to Scopes.

Configure your MCP client

  • Claude Code (CLI)

  • VS Code

  • Codex (OpenAI)

  • Cursor

  • General JSON

Where to apply the configuration

Run the MCP add command in your terminal. Claude Code auto-discovers the authorization server and required scopes.

Configuration steps

  1. Open a terminal window.

  2. Run the command to add the AIC Remote MCP Server.

  3. Run claude mcp list to confirm the server was added.

  4. On first tool use, complete the OAuth sign-in flow in the browser window that opens.

    Example command

    claude mcp add \
  --transport http \
  --client-id AICRemoteMCPClient \
  --callback-port 3000 \
  aic-mcp-server \
  https://openam-<your-tenant>.forgeblocks.com/mcp

    Example configuration

    Alternatively, add an entry to .mcp.json (project) or ~/.claude.json:

    {
  "mcpServers": {
    "aic-remote-mcp": {
      "type": "http",
      "url": "https://openam-<your-tenant>.forgeblocks.com/mcp",
      "oauth": {
        "clientId": "AICRemoteMCPClient",
        "callbackPort": 3000
      }
    }
  }
}

    Claude Desktop uses the same JSON shape in claude_desktop_config.json.

    For more information, refer to Claude Code MCP documentation.

Where to apply the configuration

Open the Command Palette and select MCP: Open User Configuration. Update the mcp.json file.

Configuration steps

  1. Open VS Code.

  2. Open the Command Palette.

  3. Run MCP: Add Server.

  4. Select HTTP as the transport type.

  5. When prompted for the server URL, enter:

    https://openam-<your-tenant>.forgeblocks.com/mcp

  6. Set the Server ID or Name to your preferred name, for example, aic-remote-mcp.

  7. Choose whether to store the configuration at the global or workspace level.

  8. Open the Command Palette again and run MCP: List Servers.

  9. If prompted for the OAuth client ID, enter AICRemoteMCPClient.

  10. If prompted for a client secret, leave the field empty and press Enter to continue.

  11. Complete the browser authentication flow when prompted. Scopes are discovered automatically.

    Example configuration

    {
  "servers": {
    "aic-mcp-server": {
      "url": "https://openam-<your-tenant>.forgeblocks.com/mcp",
      "type": "http"
    }
  }
}

    For more information, refer to Microsoft’s MCP documentation.

Where to apply the configuration

Run the MCP add command in your terminal. Alternatively, add the server to your Codex MCP configuration file.

Codex might not correctly discover the scopes offered by the server and can send incorrect scopes during sign-in. Request scopes explicitly when you log in.

Configuration steps

  1. Open a terminal window.

  2. Run the command to add the AIC Remote MCP Server.

  3. If you manage MCP servers through a config file, add the same server definition there.

  4. Run codex mcp login aic-remote-mcp --scopes aic:mcp:access,aic:mcp:identities.read to complete the OAuth sign-in flow. Request the scopes your use case requires; this example requests the scopes needed to list managed object types. Refer to Scopes for other scope combinations.

  5. If Codex does not request the correct scopes automatically, run codex mcp login aic-remote-mcp --scopes {add MCP scopes}. Replace {add MCP scopes} with a comma-separated list of the scopes your use case requires.

  6. In an interactive Codex session, enter /mcp to list the configured MCP tools. Enter /mcp verbose to view more details.

    Example command

    codex mcp add aic-remote-mcp \
  --url https://openam-<your-tenant>.forgeblocks.com/mcp \
  --oauth-client-id AICRemoteMCPClient

codex mcp login aic-remote-mcp \
  --scopes aic:mcp:access,aic:mcp:identities.read

    Example configuration file

    Place the following in ~/.codex/config.toml:

    [mcp_servers.aic-remote-mcp]
url = "https://openam-<your-tenant>.forgeblocks.com/mcp"
auth = "oauth"

[mcp_servers.aic-remote-mcp.oauth]
client_id = "AICRemoteMCPClient"
scopes = ["aic:mcp:access", "aic:mcp:identities.read"]

    For more information, refer to Codex MCP documentation.

Where to apply the configuration

In Cursor, configure the server through Settings > Tools & MCP.

Configuration steps

  1. Open Cursor.

  2. Go to Cursor Customize > MCPs.

  3. Click Add New MCP Server.

  4. Edit the config file with the example below.

  5. Save the file.

  6. Cursor discovers scopes automatically. If you use the Cursor CLI, run cursor-agent mcp login aic-remote-mcp to trigger the OAuth flow.

    Example configuration file

    Edit ~/.cursor/mcp.json (global) or .cursor/mcp.json (workspace):

    {
  "mcpServers": {
    "aic-remote-mcp": {
      "url": "https://openam-<your-tenant>.forgeblocks.com/mcp",
      "auth": {
        "CLIENT_ID": "AICRemoteMCPClient"
      }
    }
  }
}

    For more information, refer to Cursor’s MCP documentation.

Where to apply the configuration

Add the server definition to your MCP client’s configuration file. Refer to your client’s MCP documentation for the exact file location and schema.

Configuration steps

  1. Open your client’s MCP configuration file.

  2. Add the AIC Remote MCP Server using the shape below. Some clients (VS Code, for example) use servers as the top-level key instead of mcpServers.

  3. For clients that don’t auto-discover scopes, list the scopes your use case requires. Refer to Scopes.

  4. Save the file and restart the client.

  5. Complete the OAuth sign-in flow when prompted.

    Example configuration

    {
  "mcpServers": {
    "aic-remote-mcp": {
      "type": "http",
      "url": "https://openam-<your-tenant>.forgeblocks.com/mcp",
      "oauth": {
        "clientId": "AICRemoteMCPClient"
      }
    }
  }
}

Validation

After configuring any client:

  • Confirm that the client shows the AIC Remote MCP Server as connected or available.

  • Test the connection with a simple prompt, such as "List the managed object types in my PingOne Advanced Identity Cloud tenant".

  • Confirm that the OAuth redirect URI configured for your client is allowed by the tenant’s Content Security Policy (CSP), if CSP is enforced. See Content Security Policy (CSP).

The first tool invocation opens a browser for OAuth sign-in. After you authenticate, the server returns the list of managed object types in your tenant. A successful response confirms that the MCP client is authorized and the connection is working.

You can add MCP configurations for multiple PingOne Advanced Identity Cloud tenants to the same client. Use a different server name for each tenant in the MCP client configuration.

Content Security Policy (CSP)

If your PingOne Advanced Identity Cloud tenant enforces a Content Security Policy (CSP), the form-action directive must include the OAuth redirect URI used by your MCP client. Without this entry, the browser blocks the OAuth redirect and sign-in fails.

For each client you configured above, identify the redirect URI it uses for OAuth callbacks (this varies by client and by how you’ve configured it) and add that URI as a source under the form-action directive in your tenant’s CSP configuration. The example below shows http://localhost:3000 added, which is the default callback for Claude Code. Your value will differ based on your MCP client and its configuration.

Content Security Policy screen in the AIC admin console with a redirect URI added to the form-action directive

Refer to the AIC documentation on managing Content Security Policy directives for step-by-step instructions.