Define MCP Servers to Manage

To manage an MCP server with MCP gateway, configure the MCP server connection information. In MCP gateway, you can manage both external MCP servers and MCP servers enabled in Oracle Integration.

Prerequisites

Get the URL of the MCP server to which you want to connect.

For an MCP server enabled in Oracle Integration, see Get the URL for the MCP Server.
Get security information to connect to your MCP server.

Instructions

Open a project.
1. In the navigation pane, select Projects.
2. Select the project in which to define MCP servers to manage.
In the left toolbar, select MCP Gateway .
In the MCP servers section, select Add.

The Add MCP server panel appears.
Configure required fields for your MCP server:
- Name: Name for the MCP server. Provide a descriptive name.
- Identifier: Oracle Integration generates this value using the Name value.
- Description: Describe the types of tools this MCP server contains.
Click Add.

The MCP connection page is displayed.

Configure MCP server connection information.

MCP Endpoint: MCP server URL to connect. For MCP servers enabled in Oracle Integration, you can get the MCP server URL from the project details page. See Enable MCP for the Project and Get the MCP Server URL.
Optional Properties: Complete these fields if you selected JWT User Assertion for Security.

Security: Specify the security policy and configuration to connect to the MCP server.

Selected Security Policy Fields

Selected Security Policy	Fields
OAuth 2.0 Client Credentials	Access Token URI — The URL from which to obtain the access token. Client Id — The client identifier issued to the client during the registration process. You can find the client ID can be found in the confidential application. Client Secret — The client secret. You can find the client secret in the confidential application. Scope — The scope of the access request. Scopes enable you to specify which type of access you need. Scopes limit access for the OAuth token. They do not grant any additional permission beyond that which the user already possesses. Auth Request Media Type — The format of the data you want to receive. Client Authentication — You can optionally configure OAuth flows with client authentication. This is similar to the Postman user interface feature for configuring client authentication. Send client credentials as basic auth header: Pass the client ID and client secret in the header as basic authentication. Send client credentials in body: Pass the client ID and client secret in the body as form fields.
OAuth using JWT User Assertion Note: This policy is typically used on behalf of a user. This policy supports the propagation of a user identity between services. See Propagate OAuth User Identity Between Services in Using the REST Adapter with Oracle Integration 3.	Access token URI — Enter the URL to which to send a request to obtain the access token. For example: `https://accounts.google.com/o/oauth2/token` JWT headers in JSON format — Upload the JWT header file in JSON format. JWT private key alias — Enter the JWT private key alias. This is the same alias you specified when uploading the signing key certificate on the Certificates page. Scope — (Optional) Enter the scopes. Access token request — (Optional) Enter the request to obtain the access token. The format you specify can vary by service provider. See Variations of JWT Usage by Service Providers in Using the REST Adapter with Oracle Integration 3. Optional Properties: Issuer— JWT issuer. A unique identifier for the entity that issued the assertion. This is typically the entity that holds the key material used to sign or integrity-protect the assertion. Examples of issuers are OAuth clients (when assertions are self-issued) and third-party security token services. If the assertion is self-issued, the issuer value is the client identifier (`client_id`). If the assertion was issued by a security token service (STS), the issuer must identify the STS in a manner recognized by the authorization server. The assertion must contain an issuer. Subject—JWT subject. The subject typically identifies an authorized accessor for which the access token is being requested (that is, the resource owner or an authorized delegate). In some cases, this may be a pseudo anonymous identifier or other value denoting an anonymous user. When the client is acting on behalf of itself, the subject must be the value of the client's `client_id`. The assertion must contain a subject. Audience—JWT audience. A value that identifies the party or parties to process the assertion. The assertion must contain an audience that identifies the authorization server as the intended audience. The authorization server must reject any assertion that does not contain its own identity as the intended audience. Signing Key ID—JWT identifier. A unique identifier for the JWT. This helps to prevent replay attacks and ensures the token is only used once.
No Security Policy	If you select this security policy, no additional fields are displayed.

OAuth 2.0 Client Credentials

Access Token URI — The URL from which to obtain the access token.
Client Id — The client identifier issued to the client during the registration process. You can find the client ID can be found in the confidential application.
Client Secret — The client secret. You can find the client secret in the confidential application.
Scope — The scope of the access request. Scopes enable you to specify which type of access you need. Scopes limit access for the OAuth token. They do not grant any additional permission beyond that which the user already possesses.
Auth Request Media Type — The format of the data you want to receive.
Client Authentication — You can optionally configure OAuth flows with client authentication. This is similar to the Postman user interface feature for configuring client authentication.
- Send client credentials as basic auth header: Pass the client ID and client secret in the header as basic authentication.
- Send client credentials in body: Pass the client ID and client secret in the body as form fields.

OAuth using JWT User Assertion

Note:

This policy is typically used on behalf of a user.
This policy supports the propagation of a user identity between services. See Propagate OAuth User Identity Between Services in Using the REST Adapter with Oracle Integration 3.

Access token URI — Enter the URL to which to send a request to obtain the access token. For example:
```
https://accounts.google.com/o/oauth2/token
```
JWT headers in JSON format — Upload the JWT header file in JSON format.
JWT private key alias — Enter the JWT private key alias. This is the same alias you specified when uploading the signing key certificate on the Certificates page.
Scope — (Optional) Enter the scopes.
Access token request — (Optional) Enter the request to obtain the access token. The format you specify can vary by service provider. See Variations of JWT Usage by Service Providers in Using the REST Adapter with Oracle Integration 3.

Optional Properties:

Issuer— JWT issuer. A unique identifier for the entity that issued the assertion. This is typically the entity that holds the key material used to sign or integrity-protect the assertion. Examples of issuers are OAuth clients (when assertions are self-issued) and third-party security token services. If the assertion is self-issued, the issuer value is the client identifier (client_id). If the assertion was issued by a security token service (STS), the issuer must identify the STS in a manner recognized by the authorization server. The assertion must contain an issuer.
Subject—JWT subject. The subject typically identifies an authorized accessor for which the access token is being requested (that is, the resource owner or an authorized delegate). In some cases, this may be a pseudo anonymous identifier or other value denoting an anonymous user. When the client is acting on behalf of itself, the subject must be the value of the client's client_id. The assertion must contain a subject.
Audience—JWT audience. A value that identifies the party or parties to process the assertion. The assertion must contain an audience that identifies the authorization server as the intended audience. The authorization server must reject any assertion that does not contain its own identity as the intended audience.
Signing Key ID—JWT identifier. A unique identifier for the JWT. This helps to prevent replay attacks and ensures the token is only used once.

No Security Policy

If you select this security policy, no additional fields are displayed.

Click Test.
Click Save to save your MCP server connection information.
To return to the project workspace, click Go back .

Next step: You can now use MCP tool filters to control which tools are discoverable through the MCP gateway. See Create a Tool Filter Security Policy.