Build with AI

Client configuration (early access)

Connect supported artificial intelligence (AI) clients to PingOne Remote MCP Server.

Before you begin

Make sure you have:

  • An administrator role assigned in a PingOne environment.

    To allow or disallow MCP tool calls against a specific environment, an administrator with the adminMcp:update:settings permission (Environment Admin role only or a custom role) must enable the server.

  • The remote server configuration URL obtained from the MCP Server page in the Settings section of the PingOne admin console or Overview tab of the MCP Server system application.

Global configuration details

  • Universal MCP client ID: pingone-mcp-server

  • Base URL format: https://mcp.pingone.region/admin/envId/mcp

    Geography Geographical domain Example MCP server URL

    North America

    .com

    https://mcp.pingone.com/admin/envId/mcp

    Europe

    .eu

    https://mcp.pingone.eu/admin/envId/mcp

    Canada

    .ca

    https://mcp.pingone.ca/admin/envId/mcp

    Asia-Pacific

    .au

    https://mcp.pingone.au/admin/envId/mcp

Steps

Configure your AI client using the following instructions.

  • Claude Code (CLI)

  • VS Code

  • OpenAI Codex CLI

  • Cursor

  • General JSON

Where to apply the configuration

Run the MCP add command in your terminal.

Configuration steps

  1. Open a terminal window.

  2. Run the MCP add command to add the PingOne Remote MCP Server.

  3. Run mcp list or claude mcp list (if you haven’t invoked Claude) to confirm the server was added.

  4. On first use, complete the OAuth 2.0 sign-on flow in the browser window that opens.

    Example configuration

    The name of the server in the following example is user-provided and will vary based on your preference. The server name is used to reference the server in future commands.

    claude mcp add \
  --transport http \
  --client-id pingone-mcp-server \
  --callback-port 7474 \
  pingone-remote \
  https://mcp.pingone.region/admin/envId/mcp

Where to apply the configuration

Open the Command Palette and select MCP: Open User Configuration. Update the mcp.json file.

Configuration steps

  1. Open VS Code.

  2. Open the Command Palette.

  3. Run MCP: Add Server.

  4. Select HTTP as the transport type.

  5. When prompted for the server URL, enter https://mcp.pingone.region/admin/envId/mcp

  6. Set the Server ID/Name to your preferred name, for example: pingone-remote

  7. Choose whether to store the configuration at the global or workspace level.

    Result

    A pop-up window opens to prompt you to allow the authentication to auth.pingone.com.

  8. Click Allow to continue.

  9. Open the Command Palette again and run MCP: List Server.

  10. If you clicked Cancel on the pop-up window to allow the authentication to auth.pingone.com, the window appears again. Click Allow to continue.

  11. Select pingone-remote and choose Start Server.

  12. When prompted for authentication details or to bypass dynamic registration, enter pingone-mcp-server as the client ID and complete the browser authentication flow.

    Example configuration

    {
  "servers": {
    "pingone-remote-test": {
      "url": "https://mcp.pingone.com/environments/envId/mcp",
      "type": "http"
    },
      "inputs": []
  }
}

Where to apply the configuration

Run the MCP add command in your terminal. Alternatively, add the server to your Codex MCP configuration file.

Configuration steps

  1. Open a terminal window.

  2. Run the MCP add command to add the PingOne Remote MCP Server.

  3. If you manage MCP servers through a config file, add the same server definition to the config file.

  4. Complete the OAuth 2.0 sign-on flow if prompted.

    Example command

    codex mcp add
--url "https://mcp.pingone.region/admin/envId/mcp"
--oauth-client-id "pingone-mcp-server"
codex mcp login

    Example configuration file

    Place the following in ~/.codex/config.toml:

    [mcp_servers.pingone-mcp-prod]
url = "https://mcp.pingone.region/admin/envId/mcp"

[mcp_servers.pingone-mcp-prod.oauth]
client_id = "pingone-mcp-server"

Where to apply the configuration

In Cursor, configure the server from Settings > Tools & MCP.

Configuration steps

  1. Open Cursor.

  2. Go to Cursor Customize > MCPs.

  3. Click Add New MCP Server.

  4. Edit the config file using the following example.

    Example configuration file

    You can also configure Cursor by editing ~/.cursor/mcp.json:

    {
    "mcpServers": {
      "pingone": {
        "url": "https://mcp.pingone.com/environments/envId/mcp",
        "transport": "http",
        "auth": {
          "CLIENT_ID": "pingone-mcp-server"
        }
      }
    }
  }

Where to apply the configuration

Add the server definition to your MCP client’s configuration file. Refer to your client’s MCP documentation for the exact file location and schema.

Configuration steps

  1. Open your client’s MCP configuration file.

  2. Add the PingOne Remote MCP Server using the shape below. Some clients (VS Code, for example) use servers as the top-level key instead of mcpServers.

  3. If your client doesn’t auto-discover the authorization server, set the OAuth client ID to pingone-mcp-server.

  4. Save the file and restart the client.

  5. Complete the OAuth 2.0 sign-on flow when prompted.

    Example configuration

    {
  "mcpServers": {
    "pingone-remote": {
      "type": "http",
      "url": "https://mcp.pingone.com/admin/envId/mcp",
      "oauth": {
        "clientId": "pingone-mcp-server"
      }
    }
  }
}

Validation

After configuring any client:

  • Confirm that the client shows the PingOne Remote MCP Server as connected or available.

  • Test the connection with a simple prompt, such as List my PingOne environments.

  • Confirm the default redirect_uri for all supported tools is http://127.0.0.1/. For Cursor, the default redirect_uri is cursor://anysphere.cursor-mcp/oauth/callback.

A successful response confirms that the MCP client is authorized and the connection is working.

If the PingOne Remote MCP Server doesn’t appear or doesn’t respond after configuration, make sure any existing local MCP servers named "PingOne" or "DaVinci" are disabled in the same directory to avoid conflicts.

Administrators will need to reauthenticate their MCP client based on the administrator security settings.