Set up external tools with MCP Gateway

The Glean MCP Gateway lets you securely expose external tools connected to Glean — custom tools, external MCP servers, and external connector tools — to AI clients like Cursor, Claude Code, ChatGPT, Claude Desktop, and more.

Setup instructions

Prerequisites

Before configuring the MCP Gateway, complete the following prerequisites:

• Have admin access to the Glean Admin console.
• Have an Identity Provider (IdP), for example, Google, Microsoft Entra ID, or Okta already connected to Glean for single sign-on (SSO).
• Have a deployment strategy regarding which tools to expose, such as custom tools, connector tools, or external MCP servers.
• (Optional) Have an MDM provider like Jamf, Kandji, or Microsoft Intune if you plan to scale the rollout to managed devices. See Deploy MCP servers with MDM.

Recommended deployment workflow

For a successful production rollout, execute the setup in the following order:

1. Enable the gateway: Turn on the Glean MCP server functionality in the Admin console.
2. Configure auth: Enable the Glean OAuth authorization server and create static OAuth clients.
3. Connect external infrastructure: Register any external MCP servers you want Glean to proxy.
4. Define access control: Choose which tools to expose per server and apply group- and role-based access controls.
5. Provision clients: Generate the MDM installer script and distribute it via your MDM provider.
6. Maintain and monitor: Verify managed-device configuration and monitor usage with MCP Insights and audit logs.

Quick start: Connect a client in 5 minutes

Use this streamlined process to spin up a basic server and link it to a local AI client.

1. Sign in to the Glean Admin console and navigate to Platform → Glean MCP servers or visit app.glean.com/admin/mcp.
2. Click Create MCP server.
3. Click Add tools and select External tools.
4. Select the specific tools you want to make available and click Create server.
5. Copy the generated MCP URL path for the server.
6. Paste that URL into your preferred client, for example, Cursor, Claude Code, ChatGPT, or Claude Cowork to establish the connection.

For a deep dive into comprehensive server customization options, see the Create MCP servers guide.

Configure authentication

The MCP Gateway requires secure token exchange to validate client requests.

1. Enable the Glean OAuth authorization server which utilizes OAuth 2.1 authorization code grant with PKCE.
2. Establish your client registration strategy:
   • Managed deployments: Manually create static OAuth clients.
   • Supported environments: Rely on dynamic client registration where available.

For detailed implementation steps, see:

• Set up Glean MCP server
• Glean OAuth authorization server
• Authentication options

Deploy to managed devices via MDM

To push the MCP server configuration to managed endpoints at scale, use your Mobile Device Management (MDM) software.

In the Admin console, open MDM deployment and click Get started. Select MCP Servers and choose the server that exposes your tools. Clear LLM Gateway if you want an MCP-only deployment.

Generate the macOS or Windows script, distribute it through your MDM provider, and verify the host connection. See Deploy MCP servers and LLM Gateway with MDM for prerequisites and both the central hub and MCP-only installer flows.

Next steps: Manage and monitor

After your MCP Gateway is deployed, use the following guides to extend access and monitor usage.

• Proxy external servers: To connect third-party or custom internal toolsets, see Connect remote MCP servers.
• Analyze usage: To audit queries, track tool adoption, and troubleshoot connection issues post-launch, see MCP Insights.