Connecting Users to Your MCP Server
Once your MCP server is running and signs people in, your users connect their AI clients to it. Each person does it once per client; after that, their AI can work with your rules whenever they turn the connection on. This page lists what to give your users, the steps for common clients, a message you can send them, and what to check when a connection fails.
Why your users need instructions from you. The address of your server, the sign-in they will see, and, with most company identity providers, a client ID are specific to your company. AI clients change their menus often, so this page names the vendors' own documentation for each client; link your users to it rather than copying screenshots that will age.
What to Give Your Users
| Item |
Example |
Notes |
| The server's address |
https://rules.example.com/mcp |
Your application's address plus the path you mapped the endpoint to |
| A name for the connection |
Rules |
Anything recognizable; shown in the client's list of connections |
| The client ID for their AI client |
00000000-0000-0000-0000-000000000000 |
Only when you pre-registered the client in your identity provider (the usual case with Microsoft Entra ID; see Authentication and the Caller). One per client, not per person |
| How they will sign in |
"With your usual company account and multi-factor sign-in" |
So people recognize the page and trust it |
| What they may do |
"You can find, explain, write and test rules. Everything you save through the AI waits for approval in the Rule Repository." |
Their permissions are the same as in RR's screens |
Claude (Web, Desktop and Mobile)
Claude calls your server from Anthropic's cloud, not from the user's computer, for every Claude client including the desktop and mobile apps. Your server must be reachable from the public internet, or your firewall must allow Anthropic's outbound IP addresses, which Anthropic publishes under Outbound IP addresses at platform.claude.com/docs/en/api/ip-addresses.
Team and Enterprise plans: an owner adds the connector once for the organization.
- In Claude, go to Organization settings > Connectors and click Add.
- Hover over Custom and select Web.
- Enter a name and your server's address, and click Continue.
- Review the detected sign-in settings. Under OAuth client, choose Use your own OAuth client and enter the client ID you registered for Claude in your identity provider (or keep Use Claude's published identity if your identity provider accepts it).
- Click Add.
On Team plans only Owners and Primary Owners can add connectors; on Enterprise plans, people with a custom role that includes managing access to libraries can too.
Each member then connects with their own account:
- Go to Customize > Connectors.
- Find your connector (usually labeled Custom) and click Connect.
- Sign in on your company's page. Claude returns to the chat with the connector connected.
Because each person connects individually, Claude can only do what that person may do.
Pro and Max plans: each person adds it themselves.
- Go to Customize > Connectors, click + Add, then Add custom connector.
- Enter a name and your server's address, and click Continue.
- Review the sign-in settings; under OAuth client, enter the client ID you were given if your company uses one. Click Add, and sign in when asked.
Using it in a chat: click the + button at the lower left, then Connectors, and turn the connector on for the conversation.
Anthropic's own instructions: Get started with custom connectors using remote MCP.
Claude Code
Claude Code runs on the user's computer and connects from there. Add the server once from a terminal; --client-id and --callback-port are needed only when you pre-registered Claude Code in your identity provider, with the redirect address http://localhost:<port>/callback:
claude mcp add --transport http --scope user \
--client-id <client-id> --callback-port 8080 \
rules https://rules.example.com/mcp
Then sign in: run /mcp inside Claude Code and follow the browser sign-in (or, in recent versions, claude mcp login rules from the shell). --scope user makes the connection available in every project; --scope project writes it to the project's .mcp.json so a whole team shares it.
Anthropic's instructions: Claude Code documentation, MCP.
Visual Studio Code
Add the server to .vscode/mcp.json in a workspace, or to the user configuration (Command Palette: MCP: Open User Configuration):
{
"servers": {
"rules": {
"type": "http",
"url": "https://rules.example.com/mcp",
"oauth": {
"clientId": "<client-id>"
}
}
}
}
With oauth set, VS Code handles the sign-in and opens the browser on the first connection. Leave the oauth block out if your identity provider registers clients on its own.
Microsoft's instructions: MCP configuration reference.
Other Clients
Any client that connects to remote MCP servers over HTTP with OAuth sign-in works the same way: it needs the server's address and, with a pre-registered client, the client ID; it finds your identity provider on its own. Follow that client's documentation, and register it in your identity provider first if your provider requires it. Clients that run in their vendor's cloud need your server reachable from that cloud, as with Claude.
A Message You Can Send
Subject: Work with our business rules from your AI assistant
You can now connect your AI assistant to our Rule Repository and ask it to find, explain, write and test business rules in plain language.
- Server address:
https://rules.example.com/mcp
- Connection name: Rules
- Client ID (only if your AI client asks for one):
<client-id>
How to connect: [link to your intranet page with the steps above for the clients you allow].
You will sign in with your usual company account. The AI can do what you can do in the Rule Repository, but it cannot make anything live, approve, decline or delete: everything it saves waits for review there. Do not paste passwords, keys or customer data into the chat.
Questions: [your help desk].
Troubleshooting
| What the user sees |
What to check |
| The client cannot reach the server |
HTTPS certificate, DNS, and, for Claude, that Anthropic's outbound IP addresses are allowed through your firewall |
| No sign-in page appears |
The server's 401 answer and protected resource metadata (Authentication and the Caller) |
| The sign-in page shows an error about the application or redirect address |
The client is not registered in your identity provider, the client ID is wrong, or the redirect address registered does not match the client's |
| Signed in, but the connection is refused |
Your MapCaller returned null for this person, or the token's audience or scope does not match |
| Connected, but the AI says it can do nothing |
The person's permission set is view-only or empty |
| The AI saved a rule nobody can find |
It is waiting for approval: look in RR's Rule Versions grid for versions awaiting approval |