Skip to main content
NiCE KnowledgeKnowledge
NiCE Knowledge Success Center

Using the Model Context Protocol endpoint

Connect an MCP client to your site to search, get, and publish content with the client.

The NiCE Knowledge Management MCP endpoint connects your NiCE KM site to an AI client. The client must support the Model Context Protocol (MCP). MCP is an open standard that lets an AI client call a defined set of tools. Examples of MCP clients are Claude, Cursor, and ChatGPT.

When an MCP client calls the server, it acts as a specific NiCE KM user account and can only see and do what that account is permitted to do. After you connect an MCP client, the AI client can use tools to:

  • Search your knowledge base
  • Get page content and file content
  • Run built-in CSV reports
  • Create and update draft pages
  • Publish draft pages

You do not have to write API code to do this integration.

Set up the MCP endpoint

There are 4 steps to set up the MCP endpoint:

  1. Get an API key for the MCP endpoint
  2. Connect an MCP client to your site
  3. Find the tools that the MCP endpoint gives you
  4. Set the correct permissions for the API key

If you want to build a custom integration without an MCP client, refer to Integrating with Generative AI Tools via the API.

Get Authorization

Each request through the NiCE KM MCP endpoint uses a NiCE KM user account. The permissions of this account control what the MCP client can see and do. This is the same permission model that the NiCE KM REST API uses.

There are two ways to authorize an MCP client:

  • Server API Token (Bearer): a single, long-lived token bound to one user account. The client sends it in an Authorization: Bearer header. This is the simplest option and works with most MCP clients (opencode, Claude Code, Codex, Pi). Use it when one fixed identity is acceptable.
  • OAuth 2.0: the client sends the user through a browser sign-in and receives a token for that user. Use it when each user should connect as themselves. ChatGPT uses this method.

It is a best practice to create a dedicated service account user for the integration rather than using a real person's account. This makes it easy to audit activity and to scope exactly what the client can access.

The MCP endpoint does not use a separate, MCP-specific credential type. It authenticates with a Server API Token like the REST APIs use. More information is available in the Authorization Tokens documentation.

To get a Server API Token:

  1. Log in to your site as an administrator.
  2. Append Special:Integrations/Tokens to your site URL.
  3. In the Add an API token section, select the Server radio button.
  4. Enter a name for the token. For example mcp-client.
  5. Select the Generate long-term JWT (OAuth bearer token) checkbox.
  6. In the Restricted to user field, select the user account for this token.
    Refer to Permissions and security in this article.
  7. Set the JWT expiration. The default is 10 years.
  8. Select Generate API token.
  9. Copy the generated JWT. This value is your MCP API key.

The system shows the JWT only one time, so be sure to copy it when it is displayed.

Connect an MCP Client

Each site has its own MCP endpoint with the format:

https://<your-site>/@api/deki/mcp

The MCP endpoint uses the Streamable HTTP transport and is stateless. It does not keep a persistent connection open between requests.

Connect manually

Add the endpoint address and the API key to the configuration of your MCP client. Many MCP clients use a configuration file with the format:

{
  "mcpServers": {
    "expert": {
      "url": "https://<your-site>/@api/deki/mcp",
      "headers": {
        "Authorization": "Bearer <your-mcp-api-key>"
      }
    }
  }
}

Refer to the documentation of your MCP client. Find the correct location for this configuration, then restart the MCP client to connect it to your site.

After you connect the MCP client, it finds the tools in the next section. The MCP client can then use these tools during a conversation.

Let an AI agent set this up for you

If you already use an agentic CLI tool (Claude Code, opencode, Codex, Cursor), you can have the agent add the MCP endpoint for you. Copy the prompt below, replace <your-site> with your site hostname, and paste it into your agent. Set your API key in an environment variable named <CUSTOMER_SITE>_MCP_TOKEN first (using the Server API Token from Get Authorization).

First, ask me for my NiCE KM site hostname if I have not already given it to
you, and wait for my answer. Then use it as <your-site> everywhere below.

Add an MCP server named "expert" to my MCP client configuration.

- Transport: HTTP (streamable HTTP)
- URL: https://<your-site>/@api/deki/mcp
- Auth: send an "Authorization: Bearer" header whose value is my API token

Detect which agentic CLI / MCP client I am running and write the server entry
to the correct config file for that tool (for example
~/.config/opencode/opencode.json, ~/.claude.json or .mcp.json,
~/.codex/config.toml, or ~/.cursor/mcp.json). Match that tool's required schema
(for example Claude Code needs "type": "http").

Read the token from the environment variable <CUSTOMER_SITE>_MCP_TOKEN rather
than hard-coding it in the config. Tell me the exact command to set that
variable, but never print the token value back to me.

After writing the config, verify the server is reachable and list the tools it
exposes: page_search, llm_kernels, page_get, file_get, report_run,
draft_write, draft_file_write, draft_publish. If the endpoint returns HTTP 403,
tell me the MCP feature is not enabled on the site and that I need to contact my
NiCE account rep to enable it.
Reusable skill definition (SKILL.md) — copy into a skill-based agent
---
name: connect-nice-km-mcp
description: >-
  Install and verify the NiCE Knowledge Management MCP Server in the current
  agentic CLI (Claude Code, opencode, Codex, Cursor, or any MCP client). Use
  when the user asks to connect, add, or set up the NiCE KM / Expert MCP
  endpoint.
---

# Connect the NiCE Knowledge Management MCP Server

## Inputs
- SITE_HOST: the customer site hostname (e.g. help.example.com). If not provided,
  prompt the user for it and wait for their answer before doing anything else.
- TOKEN_ENV: environment variable holding the Server API Token. Default name:
  <CUSTOMER_SITE>_MCP_TOKEN. Never read, echo, or log the token value.

## Endpoint
- URL: https://SITE_HOST/@api/deki/mcp
- Transport: HTTP (streamable HTTP)
- Auth header: Authorization: Bearer ${TOKEN_ENV}

## Steps
1. If SITE_HOST was not provided, ask the user for their NiCE KM site
   hostname and wait for the answer.
2. Detect the host agent/CLI and its MCP config location and schema:
   - opencode  -> ~/.config/opencode/opencode.json  (type: "remote")
   - Claude Code -> ~/.claude.json / .mcp.json       (type: "http")
   - Codex     -> ~/.codex/config.toml               ([mcp_servers.expert], bearer_token_env_var)
   - Cursor    -> ~/.cursor/mcp.json
3. Add a server named "expert" pointing at the URL, referencing the token via
   the environment variable TOKEN_ENV. Do not hard-code the token.
4. Restart or reload the client if required.
5. Verify connectivity and list the exposed tools:
   page_search, llm_kernels, page_get, file_get, report_run,
   draft_write, draft_file_write, draft_publish.

## Failure handling
- HTTP 403 on the endpoint: the MCP feature is disabled on the site. Tell the
  user to contact their NiCE account rep to enable it. Do not retry.
- Write tools (draft_write / draft_publish) fail with an unseated-user error:
  the token's account needs a paid license seat.

## Safety
- Never print the token value. Reference it only through the environment
  variable. Do not commit the token to any file.

Standard configuration examples

These are verified configuration examples for common coding-agent CLI clients:

opencode

Add an mcp entry to your project or global opencode.json file. For example ~/.config/opencode/opencode.json. Use a remote server type and interpolate the API key from an environment variable. Do not hard-code the key in the file.

{
  "mcp": {
    "expert": {
      "type": "remote",
      "url": "https://<your-site>/@api/deki/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:EXPERT_MCP_TOKEN}"
      }
    }
  }
}

Export the API key as an environment variable before you start opencode, for example export EXPERT_MCP_TOKEN="<your-mcp-api-key>".

Claude Code

Use the claude mcp add command to register the MCP endpoint with an HTTP transport and an Authorization header:

claude mcp add --transport http expert https://<your-site>/@api/deki/mcp \
  --header "Authorization: Bearer <your-mcp-api-key>"

This command adds an equivalent entry to your .mcp.json file. If you edit the file directly, set type to http.

An entry that has a url value but no type value is treated as a misconfigured local server, and Claude Code does not load it.

{
  "mcpServers": {
    "expert": {
      "type": "http",
      "url": "https://<your-site>/@api/deki/mcp",
      "headers": {
        "Authorization": "Bearer <your-mcp-api-key>"
      }
    }
  }
}
Cursor

Add the server to your global ~/.cursor/mcp.json file (or a project-scoped .cursor/mcp.json). Cursor uses the same JSON shape as the generic example:

{
  "mcpServers": {
    "expert": {
      "url": "https://<your-site>/@api/deki/mcp",
      "headers": {
        "Authorization": "Bearer <your-mcp-api-key>"
      }
    }
  }
}

Then enable the server in Cursor Settings > MCP and confirm it shows the available tools.

Codex

Add an entry under mcp_servers to ~/.codex/config.toml, or to a project-scoped .codex/config.toml. Codex reads the API key from an environment variable; it does not accept the key directly in this field.

[mcp_servers.expert]
url = "https://<your-site>/@api/deki/mcp"
bearer_token_env_var = "EXPERT_MCP_TOKEN"

Export the environment variable in your shell configuration before you start Codex. For example add this line to .zshrc or .bashrc: export EXPERT_MCP_TOKEN="<your-mcp-api-key>".

Pi

Pi, the pi coding agent CLI from earendil-works (pi.dev), does not have native MCP client support. Pi's own extension system is a separate TypeScript API, not the standard MCP protocol.

To connect Pi to the MCP endpoint, install the community pi-mcp-adapter package:

pi install npm:pi-mcp-adapter

Then add the MCP endpoint to a project .mcp.json file or the user-global ~/.config/mcp/mcp.json file. Use bearerTokenEnv to reference an environment variable instead of the raw key:

{
  "mcpServers": {
    "expert": {
      "url": "https://<your-site>/@api/deki/mcp",
      "auth": "bearer",
      "bearerTokenEnv": "EXPERT_MCP_TOKEN"
    }
  }
}

Export the environment variable in your shell configuration. For example export EXPERT_MCP_TOKEN="<your-mcp-api-key>", then restart Pi.

Refer to pi.dev/docs/latest for the current status of MCP support in Pi.

Connect ChatGPT

ChatGPT connects to the NiCE KM MCP endpoint as a custom connector. Unlike other MCP clients, ChatGPT does not use a single long-lived API key in a header; instead, it uses OAuth 2.0 to get a token for the account that you sign in with.

There are two steps to connect ChatGPT to the MCP endpoint: first, create an OAuth client; then create the connector.

Create an OAuth client

To create the OAuth client for ChatGPT:

  1. Log in to your site as an administrator.
  2. Add Special:Integrations/Tokens to the end of your site URL.
  3. In the Add an API token section, select the OAuth radio button.
  4. Enter a name for the token. For example chatgpt-connector
  5. In the Host field, enter chatgpt.com

This value is the callback host allowlist. It must match the callback host the MCP client uses, or the connection fails. ChatGPT calls back to chatgpt.com; a different client (for example, a desktop tool that calls back to localhost) needs its own OAuth client with the matching Host.

  1. Select Generate API token.
  2. Copy the Key and Secret values that the system shows.


The system shows the values only one time, so be sure to copy them when they are displayed.

Create the connector

To create the connector, in ChatGPT:

  1. Go to Settings > Plugins.
  2. Select Create.
  3. Enter a Name and Description for the connector.
  4. In Connection, keep Server URL selected.
  5. Enter the MCP endpoint address: https://<your-site>/@api/deki/mcp.
  6. Set Authentication to OAuth.
  7. Select Advanced OAuth settings, then set these values:
    Field Value
    Registration method User-Defined OAuth Client
    OAuth Client ID The Key value from your OAuth token
    OAuth Client Secret The Secret value from your OAuth token
    Token endpoint auth method client_secret_basic
    Auth URL https://<your-site>/@app/auth/{id}/token/authorize
    Token URL https://<your-site>/@app/auth/{id}/token/access.json
    Base scopes profile, seated
  8. Select Create. ChatGPT redirects you to sign in to your site through the IdP that you chose.
  9. After you sign in, ChatGPT completes the connection.

ChatGPT can now use the connector to call the tools listed in the Available tools section of this article. When you ask ChatGPT a question about your knowledge base, ChatGPT calls the MCP endpoint and uses the result in its answer.

Settings details:

The {id} value in the Auth URL and Token URL is the numeric ID of an identity provider service on your site. Use the id of the service that the people who use this connector sign in with (for example, your SSO provider). Refer to Identity Provider Service for how to find this id with GET /@api/deki/site/services. If you are unsure which service your own account uses, call GET /@api/deki/users/current and read the service.authentication id on your user.

Leave Registration URL, Authorization server base, and Resource empty. The MCP endpoint does not support Dynamic Client Registration (DCR) or a Client Identifier Metadata Document (CIMD). ChatGPT correctly shows these registration methods as unavailable.

The profile scope is required. Every request to the authorization endpoint must include it, or the request fails.

The seated scope is required for write access. When your OAuth authorization request includes the seated scope, the resulting access token is a seated token. When it does not, the access token is explicitly unseated, and the Write Draft and Publish Draft tools fail with an unseated-user error, even if the signed-in account has a real, paid license seat. Include seated in the scopes that you request if you want to use these tools.

The New Plugin dialog in ChatGPT with Name, Description, Server URL, and Authentication fields

Available tools

The MCP endpoint gives these tools to a connected MCP client:

Tool Type What the tool does
Search Pages Read Performs a full-text search of the pages on your site, and returns the title, path, and a preview of each result
Semantic Content Search Read Finds the parts of your content that are most related to a question, and returns the correct part of a long article
Get Page Read Returns the full content of one page via the page ID or the page path
Get File Read Returns the content of a file that is attached to a page (for example, a PDF or an image)
Run Report Read Runs a built-in CSV report and returns the data as text. See Reports below.
Write Draft Write Creates a new page, or changes the draft content of a page
Write Draft File Write Attaches a file to a draft page, or replaces a file on a draft page
Publish Draft Write Publishes a draft, which makes the draft the live version of the page

The write tools use the draft workflow of NiCE KM. New content stays in draft form, and the content is not visible to your readers until you publish it. The MCP client can publish the draft with the Publish Draft tool, or a user can publish the draft manually.

Reports

The Run Report tool runs a built-in CSV report and returns the data as text. The AI client sends two things: the report name, and report parameters (if any).

The following reports are available:

Report What it returns Required parameters Permissions needed
pagedata Page data for a search query q (search query) Read access
page_restrictions The restrictions on the pages in a tree (none) Admin
search_queries What people search for (none) Admin
users The list of users (none) Admin
groups The list of groups (none) Admin
user_groups A map of users to groups Admin

Each report checks its own permissions. An AI client can only get a report that the account can already get through the REST API. For example, the users and groups reports need admin access.

If a report is not active on your site, the tool returns an error message that tells you the report is not enabled. Contact your NiCE account rep to enable it.

Troubleshooting

Symptom Cause What to do
The endpoint returns 403 Forbidden and no tools load The MCP endpoint is not enabled on your site Contact your NiCE account rep to enable it
Read tools work, but Write Draft or Publish Draft fail with an unseated-user error The token is unseated For OAuth, include the seated scope in the authorization request. For a Server API Token, use an account that owns a paid license seat
A report returns an error saying it is not enabled The report is behind a config key that is off Contact your NiCE account rep to enable it
OAuth sign-in fails with a redirect or callback error The OAuth client's Host does not match the client's callback host Create an OAuth client whose Host matches the callback host your client uses (for example chatgpt.com for ChatGPT, or localhost for a desktop tool)
The client reports the server is unavailable even though the endpoint returns HTTP 200 The client and server negotiated an incompatible protocol version Update your MCP client to the latest version and reconnect

Permissions and security

NiCE KM is a permission-based system. An API key can only see and do the tasks that its user account is permitted to do, and the MCP endpoint does not give more access than the permissions of the account.

  • If the account has access to public content only, the search and retrieval tools do not return restricted pages or private pages.
  • If the account does not have authoring permissions, the Write Draft tool, the Write Draft File tool, and the Publish Draft tool do not work for that API key.
  • If you want the MCP client to only answer questions and not change content, use an account that has neither authoring nor publishing permissions.

The MCP endpoint must be enabled on your site before any MCP client can connect. If the endpoint returns a 403 error, contact your NiCE account rep to enable it.

  • Was this article helpful?