Configuring MCP properties

Controls when the MCP server starts:

• enabled - Server starts when the integration server starts, even with 0 tools deployed
• automatic - Server starts when a tool is deployed and stops when all tools are deleted (default)
• disabled - MCP server is disabled on this integration server

Recommended: Use automatic for most deployments. Use enabled if you need the MCP server running at all times.

Example:

MCP:
  Runtime:
    mcpStartMode: 'automatic'

Hostname for the MCP server. If empty, uses the fully qualified domain name (FQDN) of the system.

Example:

MCP:
  Runtime:
    host: 'mcp.example.com'

Port number for the MCP server. The MCP server listens on this port for incoming connections from AI agents.

Important: Ensure this port is not already in use by another application and is accessible to AI agents that need to connect.

Example:

MCP:
  Runtime:
    port: 7750

URI suffix for MCP requests. The full MCP endpoint URL will be: http://hostname:port/uriSuffix

Example: With default settings, the MCP endpoint is http://localhost:7750/mcp

MCP:
  Runtime:
    uriSuffix: '/mcp'

Name of the MCP credential for securing requests to the MCP server. When set, all requests require a Basic Authorization header with the specified credentials.

The credential must be of type 'mcp' and contain username and password.

Security Note: Always configure authentication for production deployments.

Example:

MCP:
  Runtime:
    mcpCredentialName: 'myMcpCredential'

Controls whether the MCP server forwards Authorization headers from the MCP client to the REST API flow. When set to true, the Authorization header from the incoming MCP request is propagated to the REST API, allowing REST APIs that have been secured to authenticate incoming requests.

Use cases:

• Set to true (default) when your REST APIs require authentication and you want to use the same credentials from the MCP client
• Set to false when your REST APIs do not require authentication or use a different authentication mechanism

Example:

MCP:
  Runtime:
    propagateIdentity: true

Sets whether to enable HTTPS for the MCP server:

• automatic - Respects the machine-wide global settings for httpsconnector SSL unless a value is set for the sslCertificate property (default)
• disabled - Disables HTTPS for this component. This ignores the machine-wide global settings and any values for sslCertificate and sslPassword

Security Note: Always use automatic for production deployments to ensure secure communication.

Example:

MCP:
  Runtime:
    sslMode: 'automatic'

Path to the SSL certificate file. Certificate type can be p12 or pem.

For PEM certificates:

• sslCertificate is the full path to the server certificate key
• sslPassword is the full path to the server private key (must be a standard private key, not encrypted)
• File names must end with '.pem'

For P12/PFX certificates:

• sslCertificate is the full path to the server certificate store file
• sslPassword is the passphrase or alias to the passphrase of the certificate store

Example:

MCP:
  Runtime:
    sslCertificate: '/path/to/certificate.p12'
    sslPassword: 'mcp::sslpwd'

Password or path to the private key for the SSL certificate. The value depends on the certificate type (see sslCertificate for details).

Security Note: Use credential references (e.g., mcp::sslpwd) instead of plain text passwords.

Request a certificate from the client for mutual TLS authentication.

Example:

MCP:
  Runtime:
    requireClientCert: true
    caPath: '/path/to/CA/certificates'

Path to CA certificates directory. All files at this path will be read for client certificate validation when requireClientCert is enabled.

Set the list of acceptable ciphers for TLS connections. Specify the empty string to use the default cipher list. This should be a colon-separated list of upper case cipher names following the OpenSSL cipher list naming convention.

Example:

MCP:
  Runtime:
    tlsCipherList: 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256'

Enables tracing of TLS handshake to the console. Useful for debugging TLS connection issues.

Example:

MCP:
  Runtime:
    tlsTrace: true