Build with AI

Try it out

Connect the DaVinci MCP Server to your MCP client.

Prerequisites

Before you start, make sure you have:

Setup

1. Create a PingOne worker application

The DaVinci MCP Server requires a worker application to authenticate with the PingOne APIs.

  1. In the PingOne admin console, select the environment where DaVinci is enabled.

  2. Click Applications > Applications in the left navigation menu.

  3. Click + Add Application and select Worker.

    1. Enter the following:

      • Name: For example, DaVinci MCP Server.

      • Description: Optional.

    2. Click Save.

    3. Enable the application using the toggle at the top right of the details panel.

  4. On the Configuration tab, click the Edit icon and set:

    • Grant Types: Authorization Code

    • Response Type: Code

    • PKCE Enforcement: S256_REQUIRED

    • Redirect URIs: http://127.0.0.1:7474/callback

    • Token Endpoint Authentication Method: None (Public Client)

  5. Click Save.

  6. Copy the Client ID from the Configuration tab.

    You’ll need this for AUTHORIZATION_CODE_CLIENT_ID. This identifies the PingOne worker application your MCP client uses during OAuth authentication.

  7. Copy the Environment ID from the URL or environment settings.

    You’ll need this for DAVINCI_MCP_ENVIRONMENT_ID. This is the UUID of the target PingOne environment that contains the DaVinci resources the server should access.

2. Assign a role to the authenticating user

  1. In the PingOne admin console, click Directory > Users.

  2. Create a new user or select an existing one.

  3. Navigate to the user’s Roles tab and click Grant Roles.

  4. Search for and select DaVinci Admin Read Only. Click Save.

3. Configure environment variables

The server reads the following environment variables. You can set these in your MCP client configuration:

Variable Description Example

DAVINCI_MCP_ENVIRONMENT_ID

The UUID of the PingOne environment that contains your DaVinci resources. The server uses this to target API requests to the correct environment.

a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6

AUTHORIZATION_CODE_CLIENT_ID

The client ID of your PingOne worker application.

your-client-id

ROOT_DOMAIN

The regional PingOne domain. Refer to Regional and custom domain support.

pingone.com (NA), pingone.eu (EU), pingone.asia (APAC)

CUSTOM_DOMAIN

(Optional) Your custom PingOne domain. Refer to Regional and custom domain support.

auth.example.com

Install

Quick install

Use the one-click install links for the fastest setup:

When prompted for an environment ID, enter the target PingOne environment UUID, not your worker application client ID.

Install in VS Code

Install MCP Server

Manual install (NPX)

Add the following to your MCP client configuration, replacing the placeholder values with your actual credentials. Set DAVINCI_MCP_ENVIRONMENT_ID to the UUID of the PingOne environment you want the server to query:

{
  "mcpServers": {
    "davinci": {
      "command": "npx",
      "args": ["-y", "@ping-identity/davinci-mcp-server", "start"],
      "env": {
        "DAVINCI_MCP_ENVIRONMENT_ID": "your-environment-id",
        "AUTHORIZATION_CODE_CLIENT_ID": "your-client-id",
        "ROOT_DOMAIN": "pingone.com"
      }
    }
  }
}

For client-specific configuration formats, CLI flags, and advanced examples, refer to Client configuration.

Start using the DaVinci MCP Server

  1. Restart your MCP client after adding the configuration.

  2. Run a read tool such as list_flows, list_applications, or list_connectors to trigger authentication. Your browser opens automatically.

  3. Log in with the PingOne user you assigned the DaVinci Admin Read Only role.

  4. After authenticating, your MCP client can interact with your DaVinci environment.

Try prompts like:

  • "List all DaVinci flows in my environment"

  • "Show me the details of the Login flow"

  • "What connectors are available?"

  • "List all DaVinci applications"

Next steps