--- title: Client configuration (early access) description: Configure AI clients such as VS Code, Cursor, and Codex CLI to connect to the PingOne Remote MCP Server. component: build-with-ai page_id: build-with-ai:pingone-mcp-server:p1-client-configuration canonical_url: https://developer.pingidentity.com/build-with-ai/pingone-mcp-server/p1-client-configuration.html llms_txt: https://developer.pingidentity.com/build-with-ai/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-28 keywords: ["MCP", "AI", "PingOne", "Model Context Protocol", "identity orchestration"] section_ids: before-you-begin: Before you begin global-configuration-details: Global configuration details steps: Steps validation: Validation --- # Client configuration (early access) Connect supported artificial intelligence (AI) clients to PingOne Remote MCP Server. ## Before you begin Make sure you have: * An administrator role assigned in a PingOne environment. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | To allow or disallow MCP tool calls against a specific environment, an administrator with the `adminMcp:update:settings` permission (Environment Admin role only or a custom role) must enable the server. | * The remote server configuration URL obtained from the **MCP Server** page in the **Settings** section of the PingOne admin console or **Overview** tab of the MCP Server system application. ### Global configuration details * Universal MCP client ID: `pingone-mcp-server` * Base URL format: https\://mcp.pingone.region/admin/envId/mcp | Geography | Geographical domain | Example MCP server URL | | ------------- | ------------------- | ---------------------------------------- | | North America | .com | https\://mcp.pingone.com/admin/envId/mcp | | Europe | .eu | https\://mcp.pingone.eu/admin/envId/mcp | | Canada | .ca | https\://mcp.pingone.ca/admin/envId/mcp | | Asia-Pacific | .au | https\://mcp.pingone.au/admin/envId/mcp | ## Steps Configure your AI client using the following instructions. * Claude Code (CLI) * VS Code * OpenAI Codex CLI * Cursor * General JSON **Where to apply the configuration** Run the MCP add command in your terminal. **Configuration steps** 1. Open a terminal window. 2. Run the MCP add command to add the PingOne Remote MCP Server. 3. Run `mcp list` or `claude mcp list` (if you haven't invoked Claude) to confirm the server was added. 4. On first use, complete the OAuth 2.0 sign-on flow in the browser window that opens. **Example configuration** The name of the server in the following example is user-provided and will vary based on your preference. The server name is used to reference the server in future commands. ```shell claude mcp add \ --transport http \ --client-id pingone-mcp-server \ --callback-port 7474 \ pingone-remote \ https://mcp.pingone.region/admin/envId/mcp ``` **Where to apply the configuration** Open the **Command Palette** and select **MCP: Open User Configuration**. Update the `mcp.json` file. **Configuration steps** 1. Open VS Code. 2. Open the **Command Palette**. 3. Run **MCP: Add Server**. 4. Select **HTTP** as the transport type. 5. When prompted for the server URL, enter https\://mcp.pingone.region/admin/envId/mcp 6. Set the **Server ID/Name** to your preferred name, for example: `pingone-remote` 7. Choose whether to store the configuration at the global or workspace level. Result A pop-up window opens to prompt you to allow the authentication to auth.pingone.com. 8. Click **Allow** to continue. 9. Open the **Command Palette** again and run **MCP: List Server**. 10. If you clicked **Cancel** on the pop-up window to allow the authentication to auth.pingone.com, the window appears again. Click **Allow** to continue. 11. Select **pingone-remote** and choose **Start Server**. 12. When prompted for authentication details or to bypass dynamic registration, enter `pingone-mcp-server` as the client ID and complete the browser authentication flow. **Example configuration** ```json { "servers": { "pingone-remote-test": { "url": "https://mcp.pingone.com/environments/envId/mcp", "type": "http" }, "inputs": [] } } ``` **Where to apply the configuration** Run the MCP add command in your terminal. Alternatively, add the server to your Codex MCP configuration file. **Configuration steps** 1. Open a terminal window. 2. Run the MCP add command to add the PingOne Remote MCP Server. 3. If you manage MCP servers through a config file, add the same server definition to the config file. 4. Complete the OAuth 2.0 sign-on flow if prompted. **Example command** ```shell codex mcp add --url "https://mcp.pingone.region/admin/envId/mcp" --oauth-client-id "pingone-mcp-server" codex mcp login ``` **Example configuration file** Place the following in `~/.codex/config.toml`: ```toml [mcp_servers.pingone-mcp-prod] url = "https://mcp.pingone.region/admin/envId/mcp" [mcp_servers.pingone-mcp-prod.oauth] client_id = "pingone-mcp-server" ``` **Where to apply the configuration** In Cursor, configure the server from **Settings > Tools & MCP**. **Configuration steps** 1. Open Cursor. 2. Go to **Cursor Customize > MCPs**. 3. Click **Add New MCP Server**. 4. Edit the config file using the following example. **Example configuration file** You can also configure Cursor by editing `~/.cursor/mcp.json`: ```json { "mcpServers": { "pingone": { "url": "https://mcp.pingone.com/environments/envId/mcp", "transport": "http", "auth": { "CLIENT_ID": "pingone-mcp-server" } } } } ``` **Where to apply the configuration** Add the server definition to your MCP client's configuration file. Refer to your client's MCP documentation for the exact file location and schema. **Configuration steps** 1. Open your client's MCP configuration file. 2. Add the PingOne Remote MCP Server using the shape below. Some clients (VS Code, for example) use `servers` as the top-level key instead of `mcpServers`. 3. If your client doesn't auto-discover the authorization server, set the OAuth client ID to `pingone-mcp-server`. 4. Save the file and restart the client. 5. Complete the OAuth 2.0 sign-on flow when prompted. **Example configuration** ```json { "mcpServers": { "pingone-remote": { "type": "http", "url": "https://mcp.pingone.com/admin/envId/mcp", "oauth": { "clientId": "pingone-mcp-server" } } } } ``` ## Validation After configuring any client: * Confirm that the client shows the PingOne Remote MCP Server as connected or available. * Test the connection with a simple prompt, such as `List my PingOne environments`. * Confirm the default `redirect_uri` for all supported tools is `http://127.0.0.1/`. For Cursor, the default `redirect_uri` is `cursor://anysphere.cursor-mcp/oauth/callback`. A successful response confirms that the MCP client is authorized and the connection is working. If the PingOne Remote MCP Server doesn't appear or doesn't respond after configuration, make sure any existing local MCP servers named "PingOne" or "DaVinci" are disabled in the same directory to avoid conflicts. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Administrators will need to reauthenticate their MCP client based on the [administrator security settings](https://docs.pingidentity.com/pingone/settings/p1_configure_administrator_security.html). |