--- title: Getting started description: Configure a supported AI client to connect to the AIC Remote MCP Server. component: build-with-ai page_id: build-with-ai:aic-remote-mcp-server:getting-started canonical_url: https://developer.pingidentity.com/build-with-ai/aic-remote-mcp-server/getting-started.html llms_txt: https://developer.pingidentity.com/build-with-ai/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-20 keywords: ["MCP", "AI", "AIC", "PingOne Advanced Identity Cloud", "Model Context Protocol", "client configuration"] section_ids: prerequisites: Prerequisites server-details: Server details configure-your-mcp-client: Configure your MCP client validation: Validation content-security-policy-csp: Content Security Policy (CSP) --- # Getting started | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The AIC Remote MCP Server is currently available in **Rapid (Sandbox)** environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks. | For more information on how to have the AIC Remote MCP Server enabled, refer to [Overview](overview.html). Connect a supported AI client to the AIC Remote MCP Server. ## Prerequisites Before you configure a client, make sure you have: * A PingOne Advanced Identity Cloud tenant with the AIC Remote MCP Server enabled. * An MCP-compatible client. This page provides step-by-step configuration for Claude Code, VS Code with GitHub Copilot, OpenAI Codex CLI, and Cursor. If your client isn't listed, use the General JSON tab below and adapt it. ## Server details Use these values in every client configuration below: | Field | Value | | --------------- | ---------------------------------------------------------------------------------------------------------------- | | Server URL | `https://openam-.forgeblocks.com/mcp` (substitute `` with your tenant hostname prefix) | | OAuth client ID | `AICRemoteMCPClient` (public client, authorization code with PKCE, no secret) | | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Only the default AM FQDN (`openam-.forgeblocks.com`) is supported as the server URL. Custom domain aliases are not supported and will result in a CORS error. | | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Some MCP clients let you specify the OAuth redirect URI instead of using a fixed value. If your client provides this option, use a loopback URI such as `http://localhost:3000`, and make sure the client listens on that address for the OAuth callback. Use the exact same URI in the `form-action` directive if your tenant enforces a [Content Security Policy (CSP)](#_content_security_policy_csp). | | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Clients that support [RFC 9728 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728) discover the authorization server and required scopes automatically. Clients that don't must list them explicitly. Refer to [Scopes](scopes.html). | ## Configure your MCP client * Claude Code (CLI) * VS Code * Codex (OpenAI) * Cursor * General JSON **Where to apply the configuration** Run the MCP add command in your terminal. Claude Code auto-discovers the authorization server and required scopes. **Configuration steps** 1. Open a terminal window. 2. Run the command to add the AIC Remote MCP Server. 3. Run `claude mcp list` to confirm the server was added. 4. On first tool use, complete the OAuth sign-in flow in the browser window that opens. **Example command** ```shell claude mcp add \ --transport http \ --client-id AICRemoteMCPClient \ --callback-port 3000 \ aic-mcp-server \ https://openam-.forgeblocks.com/mcp ``` **Example configuration** Alternatively, add an entry to `.mcp.json` (project) or `~/.claude.json`: ```json { "mcpServers": { "aic-remote-mcp": { "type": "http", "url": "https://openam-.forgeblocks.com/mcp", "oauth": { "clientId": "AICRemoteMCPClient", "callbackPort": 3000 } } } } ``` Claude Desktop uses the same JSON shape in `claude_desktop_config.json`. For more information, refer to [Claude Code MCP documentation](https://docs.anthropic.com/en/docs/claude-code/mcp). **Where to apply the configuration** Open the **Command Palette** and select **MCP: Open User Configuration**. Update the `mcp.json` file. **Configuration steps** 1. Open VS Code. 2. Open the Command Palette. 3. Run **MCP: Add Server**. 4. Select **HTTP** as the transport type. 5. When prompted for the server URL, enter: `https://openam-.forgeblocks.com/mcp` 6. Set the Server ID or Name to your preferred name, for example, `aic-remote-mcp`. 7. Choose whether to store the configuration at the global or workspace level. 8. Open the Command Palette again and run **MCP: List Servers**. 9. If prompted for the OAuth client ID, enter `AICRemoteMCPClient`. 10. If prompted for a client secret, leave the field empty and press Enter to continue. 11. Complete the browser authentication flow when prompted. Scopes are discovered automatically. **Example configuration** ```json { "servers": { "aic-mcp-server": { "url": "https://openam-.forgeblocks.com/mcp", "type": "http" } } } ``` For more information, refer to [Microsoft's MCP documentation](https://code.visualstudio.com/docs/copilot/customization/mcp-servers). **Where to apply the configuration** Run the MCP add command in your terminal. Alternatively, add the server to your Codex MCP configuration file. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | Codex might not correctly discover the scopes offered by the server and can send incorrect scopes during sign-in. Request scopes explicitly when you log in. | **Configuration steps** 1. Open a terminal window. 2. Run the command to add the AIC Remote MCP Server. 3. If you manage MCP servers through a config file, add the same server definition there. 4. Run `codex mcp login aic-remote-mcp --scopes aic:mcp:access,aic:mcp:identities.read` to complete the OAuth sign-in flow. Request the scopes your use case requires; this example requests the scopes needed to list managed object types. Refer to [Scopes](scopes.html) for other scope combinations. 5. If Codex does not request the correct scopes automatically, run `codex mcp login aic-remote-mcp --scopes {add MCP scopes}`. Replace `{add MCP scopes}` with a comma-separated list of the scopes your use case requires. 6. In an interactive Codex session, enter `/mcp` to list the configured MCP tools. Enter `/mcp verbose` to view more details. **Example command** ```shell codex mcp add aic-remote-mcp \ --url https://openam-.forgeblocks.com/mcp \ --oauth-client-id AICRemoteMCPClient codex mcp login aic-remote-mcp \ --scopes aic:mcp:access,aic:mcp:identities.read ``` **Example configuration file** Place the following in `~/.codex/config.toml`: ```toml [mcp_servers.aic-remote-mcp] url = "https://openam-.forgeblocks.com/mcp" auth = "oauth" [mcp_servers.aic-remote-mcp.oauth] client_id = "AICRemoteMCPClient" scopes = ["aic:mcp:access", "aic:mcp:identities.read"] ``` For more information, refer to [Codex MCP documentation](https://developers.openai.com/codex/mcp/). **Where to apply the configuration** In Cursor, configure the server through **Settings** > **Tools & MCP**. **Configuration steps** 1. Open Cursor. 2. Go to **Cursor Customize** > **MCPs**. 3. Click **Add New MCP Server**. 4. Edit the config file with the example below. 5. Save the file. 6. Cursor discovers scopes automatically. If you use the Cursor CLI, run `cursor-agent mcp login aic-remote-mcp` to trigger the OAuth flow. **Example configuration file** Edit `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (workspace): ```json { "mcpServers": { "aic-remote-mcp": { "url": "https://openam-.forgeblocks.com/mcp", "auth": { "CLIENT_ID": "AICRemoteMCPClient" } } } } ``` For more information, refer to [Cursor's MCP documentation](https://cursor.com/docs/mcp). **Where to apply the configuration** Add the server definition to your MCP client's configuration file. Refer to your client's MCP documentation for the exact file location and schema. **Configuration steps** 1. Open your client's MCP configuration file. 2. Add the AIC Remote MCP Server using the shape below. Some clients (VS Code, for example) use `servers` as the top-level key instead of `mcpServers`. 3. For clients that don't auto-discover scopes, list the scopes your use case requires. Refer to [Scopes](scopes.html). 4. Save the file and restart the client. 5. Complete the OAuth sign-in flow when prompted. **Example configuration** ```json { "mcpServers": { "aic-remote-mcp": { "type": "http", "url": "https://openam-.forgeblocks.com/mcp", "oauth": { "clientId": "AICRemoteMCPClient" } } } } ``` ## Validation After configuring any client: * Confirm that the client shows the AIC Remote MCP Server as connected or available. * Test the connection with a simple prompt, such as *"List the managed object types in my PingOne Advanced Identity Cloud tenant"*. * Confirm that the OAuth redirect URI configured for your client is allowed by the tenant's Content Security Policy (CSP), if CSP is enforced. See [Content Security Policy (CSP)](#_content_security_policy_csp). The first tool invocation opens a browser for OAuth sign-in. After you authenticate, the server returns the list of managed object types in your tenant. A successful response confirms that the MCP client is authorized and the connection is working. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | You can add MCP configurations for multiple PingOne Advanced Identity Cloud tenants to the same client. Use a different server name for each tenant in the MCP client configuration. | ## Content Security Policy (CSP) If your PingOne Advanced Identity Cloud tenant enforces a [Content Security Policy](https://docs.pingidentity.com/pingoneaic/tenants/content-security-policy.html) (CSP), the `form-action` directive must include the OAuth redirect URI used by your MCP client. Without this entry, the browser blocks the OAuth redirect and sign-in fails. For each client you configured above, identify the redirect URI it uses for OAuth callbacks (this varies by client and by how you've configured it) and add that URI as a source under the `form-action` directive in your tenant's CSP configuration. The example below shows `http://localhost:3000` added, which is the default callback for Claude Code. Your value will differ based on your MCP client and its configuration. ![Content Security Policy screen in the AIC admin console with a redirect URI added to the form-action directive](_images/csp-form-action.png) Refer to the AIC documentation on [managing Content Security Policy directives](https://docs.pingidentity.com/pingoneaic/tenants/content-security-policy.html) for step-by-step instructions.