Connect an MCP host to Elastic Agent Builder

The Claude Code CLI supports OAuth natively, so no additional adapter is required.

Run the following command, replacing {CLIENT_ID} and {MCP_SERVER_URL} with the values for your OAuth client:

claude mcp add --transport http --client-id {CLIENT_ID} kibana-mcp {MCP_SERVER_URL}

claude mcp add --transport http --client-id {CLIENT_ID} --client-secret kibana-mcp {MCP_SERVER_URL}

When Claude Code starts the OAuth flow, it listens for the authorization response at http://localhost/callback. This is one of the default redirect URIs populated in the OAuth client registration form, so it should be included in your client's redirect URIs unless you explicitly removed it.

claude mcp add --transport stdio kibana-mcp -- \
  npx mcp-remote \
  "{MCP_SERVER_URL}" \
  --static-oauth-client-info \
  "{\"client_id\":\"{CLIENT_ID}\"}"

The Claude desktop app supports OAuth natively, so no additional adapter is required.

To configure the Claude desktop app:

1. Start the Claude desktop app and log in.
2. Open Settings → Connectors → Add → Add custom connector.
3. Enter a name, the URL, and Client ID.

4. Click Add.
5. Click Connect.

When Claude desktop starts the OAuth flow, it expects an authorization callback at https://claude.ai/api/mcp/auth_callback. If you get an authorization error, check the OAuth client you created includes this redirect URI.

The Claude web interface (https://claude.ai) supports OAuth natively, so no additional adapter is required.

To connect from claude.ai:

1. Log in to claude.ai.
2. Click your account menu, and then go to Settings → Connectors → Add → Add custom connector.
3. Enter a name, the URL, and Client ID. Confidential clients also require a Client Secret.
4. Click Add.
5. Click Connect

When the Claude web interface starts the OAuth flow, it listens for the authorization response at https://claude.ai/api/mcp/auth_callback. If you get an authorization error, check the OAuth client you created includes this redirect URI.

ChatGPT supports OAuth natively for custom MCP apps.

To connect from ChatGPT:

1. Go to Settings → Security and login and enable Developer mode.
2. Go to Settings → Plugins, then click the plus button to create a new plugin.
3. Enter a name and the MCP server URL, and select OAuth as the authentication type.
4. Under Registration method, select User-Defined OAuth Client.
5. Copy the Callback URL that ChatGPT displays. This URL is unique to the app and looks like https://chatgpt.com/connector/oauth/{callback_id}. Open your OAuth client in a separate tab and add this URL as a Remote redirect URI.
6. Return to ChatGPT. Enter the Client ID and Client Secret from your Elastic OAuth client.
7. Click Scan Tools to start the OAuth flow, then complete the authorization prompt.

Cursor supports OAuth natively for remote MCP servers through mcp.json.

To connect from Cursor:

1. Open your Cursor MCP configuration file. Use .cursor/mcp.json for project-specific config, or ~/.cursor/mcp.json for global config.

2. Add the server with static OAuth credentials:

   {
     "mcpServers": {
       "kibana-mcp": {
         "url": "{MCP_SERVER_URL}",
         "auth": {
           "CLIENT_ID": "{CLIENT_ID}",
           "CLIENT_SECRET": "{CLIENT_SECRET}"
         }
       }
     }
   }
   

   Replace {MCP_SERVER_URL}, {CLIENT_ID}, and {CLIENT_SECRET} with the values for your OAuth client. For public clients, omit the CLIENT_SECRET field.

3. Open Cursor Settings → Tools & MCP. The server appears with a Connect button.

4. Click Connect to start the OAuth flow.

When Cursor starts the OAuth flow, it redirects to one of two callback URLs depending on the surface:

• Cursor desktop: http://localhost:8787/callback. The authorization server accepts any localhost port, and /callback is one of the default redirect URIs populated in the OAuth client registration form, so it should be included in your client's redirect URIs unless you explicitly removed it.
• Cursor web and Cursor Agents: https://www.cursor.com/agents/mcp/oauth/callback. If you get an authorization error, check that your OAuth client includes this as a Remote redirect URI.

AgentCore Gateway connects to Elastic Agent Builder through an outbound OAuth client in AgentCore Identity.

Before you start, make sure you have:

• An Elastic Agent Builder OAuth client with a client secret.
• An outbound OAuth client in AgentCore Identity that uses the client ID and client secret of your Elastic Agent Builder OAuth client.

To connect from AgentCore Gateway:

1. In AgentCore Identity, open your outbound OAuth client and copy its Callback URL. It looks like https://bedrock-agentcore.{region}.amazonaws.com/identities/oauth2/callback/{id}.
2. Edit your Elastic Agent Builder OAuth client and add the callback URL as a Remote redirect URI.
3. In your gateway, add an MCP server target and set its endpoint to your MCP server URL. For a passthrough target, remove the /mcp suffix from the URL, because AgentCore appends it to each request.
4. For the target's outbound authentication, select your outbound OAuth client, select Authorization code grant (3LO) as the grant type, and add the all scope.
5. In the Return URL field, enter the https:// endpoint of the application that completes authorization for your users. Browsers block the redirect to http:// return URLs.

After a user authorizes, AgentCore redirects them to your return URL with a session ID. Your application must call the AgentCore CompleteResourceTokenAuth API with that session ID to finish authorization. For details, refer to Authentication with an authorization code grant when invoking a gateway.

Most hosts that support OAuth 2.1 accept a similar configuration to Claude. Provide the {MCP_SERVER_URL} and {CLIENT_ID} in the format your host requires.