Follow Security and Connection Best Practices

Use the following practices when you connect an AI client to the Essbase MCP server.

Use HTTPS

Always use an HTTPS URL for the MCP endpoint. Example:

https://<essbase-server>/essbase/rest/v1/ess-mcp

Do not connect a remote client to the Essbase MCP server over plain HTTP. HTTPS protects tokens and other connection data while they are in transit.

Register a Redirect URI for Each Client

Each OAuth client uses its own callback URL.

Register the redirect URI required by each client in the Oracle Identity Domain confidential application. ChatGPT, Claude Code, and Codex may use different callback URLs, so do not assume that one redirect URI works for every client.

Protect Client Secrets and Tokens

Do not place client secrets or bearer tokens in shared configuration files, source control, screenshots, or documentation. Use the secure storage method supported by each client:

  • ChatGPT stores the client secret in the connector configuration.
  • Claude Code stores the client secret in the operating system keychain.
  • Codex should read the bearer token from an environment variable by using bearer_token_env_var.

Do not place a client secret directly in config.toml.

Plan for Token Expiration

Bearer tokens expire. The default Oracle Identity Domain token lifetime is often 3600 seconds, although your environment may use a different value. Regenerate or refresh the token after it expires.

Use the Correct Authentication Method

The token endpoint authentication method must match the OAuth client type and the confidential application configuration.

  • Use client_secret_post or client_secret_basic for a confidential client that has a client secret.
  • Use none only for a public client that uses PKCE and does not have a client secret.

Start with Read-Only Access

For a first connection, use the viewer profile:

?profile=viewer

Confirm that authentication and tool discovery work before changing to the analyst or admin profile.

Apply Least Privilege

Choose the narrowest access profile that supports the required task.

The access profile controls which MCP tools the client can see. Essbase security still controls which applications, databases, members, and operations the authenticated user can access.

Refresh the Client After MCP Changes

Reconnect or refresh the client after the MCP server configuration or tool catalog changes. This allows the client to retrieve the current list of available tools and capabilities.