Using the Model Context Protocol endpoint
Connect an MCP client to your site to search, get, and publish content with the client.
The NiCE Knowledge Management MCP endpoint connects your NiCE KM site to an AI client. The client must support the Model Context Protocol (MCP). MCP is an open standard that lets an AI client call a defined set of tools. Examples of MCP clients are Claude, Cursor, and ChatGPT.
When an MCP client calls the server, it acts as a specific NiCE KM user account and can only see and do what that account is permitted to do. After you connect an MCP client, the AI client can use tools to:
- Search your knowledge base
- Get page content and file content
- Run built-in CSV reports
- Create and update draft pages
- Publish draft pages
You do not have to write API code to do this integration.
Set up the MCP endpoint
There are 4 steps to set up the MCP endpoint:
- Get an API key for the MCP endpoint
- Connect an MCP client to your site
- Find the tools that the MCP endpoint gives you
- Set the correct permissions for the API key
If you want to build a custom integration without an MCP client, refer to Integrating with Generative AI Tools via the API.
Get Authorization
Each request through the NiCE KM MCP endpoint uses a NiCE KM user account. The permissions of this account control what the MCP client can see and do. This is the same permission model that the NiCE KM REST API uses.
There are two ways to authorize an MCP client:
- Server API Token (Bearer): a single, long-lived token bound to one user account. The client sends it in an
Authorization: Bearerheader. This is the simplest option and works with most MCP clients (opencode, Claude Code, Codex, Pi). Use it when one fixed identity is acceptable. - OAuth 2.0: the client sends the user through a browser sign-in and receives a token for that user. Use it when each user should connect as themselves. ChatGPT uses this method.
It is a best practice to create a dedicated service account user for the integration rather than using a real person's account. This makes it easy to audit activity and to scope exactly what the client can access.
The MCP endpoint does not use a separate, MCP-specific credential type. It authenticates with a Server API Token like the REST APIs use. More information is available in the Authorization Tokens documentation.
To get a Server API Token:
- Log in to your site as an administrator.
- Append Special:Integrations/Tokens to your site URL.
- In the Add an API token section, select the Server radio button.
- Enter a name for the token. For example
mcp-client. - Select the Generate long-term JWT (OAuth bearer token) checkbox.
- In the Restricted to user field, select the user account for this token.
Refer to Permissions and security in this article. - Set the JWT expiration. The default is 10 years.
- Select Generate API token.
- Copy the generated JWT. This value is your MCP API key.
The system shows the JWT only one time, so be sure to copy it when it is displayed.
Connect an MCP Client
Each site has its own MCP endpoint with the format:
https://<your-site>/@api/deki/mcp
The MCP endpoint uses the Streamable HTTP transport and is stateless. It does not keep a persistent connection open between requests.
Connect manually
Add the endpoint address and the API key to the configuration of your MCP client. Many MCP clients use a configuration file with the format:
{
"mcpServers": {
"expert": {
"url": "https://<your-site>/@api/deki/mcp",
"headers": {
"Authorization": "Bearer <your-mcp-api-key>"
}
}
}
}
Refer to the documentation of your MCP client. Find the correct location for this configuration, then restart the MCP client to connect it to your site.
After you connect the MCP client, it finds the tools in the next section. The MCP client can then use these tools during a conversation.
Let an AI agent set this up for you
If you already use an agentic CLI tool (Claude Code, opencode, Codex, Cursor), you can have the agent add the MCP endpoint for you. Copy the prompt below, replace <your-site> with your site hostname, and paste it into your agent. Set your API key in an environment variable named <CUSTOMER_SITE>_MCP_TOKEN first (using the Server API Token from Get Authorization).
First, ask me for my NiCE KM site hostname if I have not already given it to you, and wait for my answer. Then use it as <your-site> everywhere below. Add an MCP server named "expert" to my MCP client configuration. - Transport: HTTP (streamable HTTP) - URL: https://<your-site>/@api/deki/mcp - Auth: send an "Authorization: Bearer" header whose value is my API token Detect which agentic CLI / MCP client I am running and write the server entry to the correct config file for that tool (for example ~/.config/opencode/opencode.json, ~/.claude.json or .mcp.json, ~/.codex/config.toml, or ~/.cursor/mcp.json). Match that tool's required schema (for example Claude Code needs "type": "http"). Read the token from the environment variable <CUSTOMER_SITE>_MCP_TOKEN rather than hard-coding it in the config. Tell me the exact command to set that variable, but never print the token value back to me. After writing the config, verify the server is reachable and list the tools it exposes: page_search, llm_kernels, page_get, file_get, report_run, draft_write, draft_file_write, draft_publish. If the endpoint returns HTTP 403, tell me the MCP feature is not enabled on the site and that I need to contact my NiCE account rep to enable it.
Reusable skill definition (SKILL.md) — copy into a skill-based agent
---
name: connect-nice-km-mcp
description: >-
Install and verify the NiCE Knowledge Management MCP Server in the current
agentic CLI (Claude Code, opencode, Codex, Cursor, or any MCP client). Use
when the user asks to connect, add, or set up the NiCE KM / Expert MCP
endpoint.
---
# Connect the NiCE Knowledge Management MCP Server
## Inputs
- SITE_HOST: the customer site hostname (e.g. help.example.com). If not provided,
prompt the user for it and wait for their answer before doing anything else.
- TOKEN_ENV: environment variable holding the Server API Token. Default name:
<CUSTOMER_SITE>_MCP_TOKEN. Never read, echo, or log the token value.
## Endpoint
- URL: https://SITE_HOST/@api/deki/mcp
- Transport: HTTP (streamable HTTP)
- Auth header: Authorization: Bearer ${TOKEN_ENV}
## Steps
1. If SITE_HOST was not provided, ask the user for their NiCE KM site
hostname and wait for the answer.
2. Detect the host agent/CLI and its MCP config location and schema:
- opencode -> ~/.config/opencode/opencode.json (type: "remote")
- Claude Code -> ~/.claude.json / .mcp.json (type: "http")
- Codex -> ~/.codex/config.toml ([mcp_servers.expert], bearer_token_env_var)
- Cursor -> ~/.cursor/mcp.json
3. Add a server named "expert" pointing at the URL, referencing the token via
the environment variable TOKEN_ENV. Do not hard-code the token.
4. Restart or reload the client if required.
5. Verify connectivity and list the exposed tools:
page_search, llm_kernels, page_get, file_get, report_run,
draft_write, draft_file_write, draft_publish.
## Failure handling
- HTTP 403 on the endpoint: the MCP feature is disabled on the site. Tell the
user to contact their NiCE account rep to enable it. Do not retry.
- Write tools (draft_write / draft_publish) fail with an unseated-user error:
the token's account needs a paid license seat.
## Safety
- Never print the token value. Reference it only through the environment
variable. Do not commit the token to any file.
Standard configuration examples
These are verified configuration examples for common coding-agent CLI clients:
opencode
Add an mcp entry to your project or global opencode.json file. For example ~/.config/opencode/opencode.json. Use a remote server type and interpolate the API key from an environment variable. Do not hard-code the key in the file.
{
"mcp": {
"expert": {
"type": "remote",
"url": "https://<your-site>/@api/deki/mcp",
"enabled": true,
"headers": {
"Authorization": "Bearer {env:EXPERT_MCP_TOKEN}"
}
}
}
}
Export the API key as an environment variable before you start opencode, for example export EXPERT_MCP_TOKEN="<your-mcp-api-key>".
Claude Code
Use the claude mcp add command to register the MCP endpoint with an HTTP transport and an Authorization header:
claude mcp add --transport http expert https://<your-site>/@api/deki/mcp \ --header "Authorization: Bearer <your-mcp-api-key>"
This command adds an equivalent entry to your .mcp.json file. If you edit the file directly, set type to http.
An entry that has a url value but no type value is treated as a misconfigured local server, and Claude Code does not load it.
{
"mcpServers": {
"expert": {
"type": "http",
"url": "https://<your-site>/@api/deki/mcp",
"headers": {
"Authorization": "Bearer <your-mcp-api-key>"
}
}
}
}
Cursor
Add the server to your global ~/.cursor/mcp.json file (or a project-scoped .cursor/mcp.json). Cursor uses the same JSON shape as the generic example:
{
"mcpServers": {
"expert": {
"url": "https://<your-site>/@api/deki/mcp",
"headers": {
"Authorization": "Bearer <your-mcp-api-key>"
}
}
}
}
Then enable the server in Cursor Settings > MCP and confirm it shows the available tools.
Codex
Add an entry under mcp_servers to ~/.codex/config.toml, or to a project-scoped .codex/config.toml. Codex reads the API key from an environment variable; it does not accept the key directly in this field.
[mcp_servers.expert] url = "https://<your-site>/@api/deki/mcp" bearer_token_env_var = "EXPERT_MCP_TOKEN"
Export the environment variable in your shell configuration before you start Codex. For example add this line to .zshrc or .bashrc: export EXPERT_MCP_TOKEN="<your-mcp-api-key>".
Pi
Pi, the pi coding agent CLI from earendil-works (pi.dev), does not have native MCP client support. Pi's own extension system is a separate TypeScript API, not the standard MCP protocol.
To connect Pi to the MCP endpoint, install the community pi-mcp-adapter package:
pi install npm:pi-mcp-adapter
Then add the MCP endpoint to a project .mcp.json file or the user-global ~/.config/mcp/mcp.json file. Use bearerTokenEnv to reference an environment variable instead of the raw key:
{
"mcpServers": {
"expert": {
"url": "https://<your-site>/@api/deki/mcp",
"auth": "bearer",
"bearerTokenEnv": "EXPERT_MCP_TOKEN"
}
}
}
Export the environment variable in your shell configuration. For example export EXPERT_MCP_TOKEN="<your-mcp-api-key>", then restart Pi.
Refer to pi.dev/docs/latest for the current status of MCP support in Pi.
Connect ChatGPT
ChatGPT connects to the NiCE KM MCP endpoint as a custom connector. Unlike other MCP clients, ChatGPT does not use a single long-lived API key in a header; instead, it uses OAuth 2.0 to get a token for the account that you sign in with.
There are two steps to connect ChatGPT to the MCP endpoint: first, create an OAuth client; then create the connector.
Create an OAuth client
To create the OAuth client for ChatGPT:
- Log in to your site as an administrator.
- Add Special:Integrations/Tokens to the end of your site URL.
- In the Add an API token section, select the OAuth radio button.
- Enter a name for the token. For example
chatgpt-connector - In the Host field, enter
chatgpt.com
This value is the callback host allowlist. It must match the callback host the MCP client uses, or the connection fails. ChatGPT calls back to chatgpt.com; a different client (for example, a desktop tool that calls back to localhost) needs its own OAuth client with the matching Host.
- Select Generate API token.
- Copy the Key and Secret values that the system shows.
The system shows the values only one time, so be sure to copy them when they are displayed.
Create the connector
To create the connector, in ChatGPT:
- Go to Settings > Plugins.
- Select Create.
- Enter a Name and Description for the connector.
- In Connection, keep Server URL selected.
- Enter the MCP endpoint address:
https://<your-site>/@api/deki/mcp. - Set Authentication to OAuth.
- Select Advanced OAuth settings, then set these values:
Field Value Registration method User-Defined OAuth Client OAuth Client ID The Key value from your OAuth token OAuth Client Secret The Secret value from your OAuth token Token endpoint auth method client_secret_basicAuth URL https://<your-site>/@app/auth/{id}/token/authorizeToken URL https://<your-site>/@app/auth/{id}/token/access.jsonBase scopes profile, seated - Select Create. ChatGPT redirects you to sign in to your site through the IdP that you chose.
- After you sign in, ChatGPT completes the connection.
ChatGPT can now use the connector to call the tools listed in the Available tools section of this article. When you ask ChatGPT a question about your knowledge base, ChatGPT calls the MCP endpoint and uses the result in its answer.
Settings details:
The {id} value in the Auth URL and Token URL is the numeric ID of an identity provider service on your site. Use the id of the service that the people who use this connector sign in with (for example, your SSO provider). Refer to Identity Provider Service for how to find this id with GET /@api/deki/site/services. If you are unsure which service your own account uses, call GET /@api/deki/users/current and read the service.authentication id on your user.
Leave Registration URL, Authorization server base, and Resource empty. The MCP endpoint does not support Dynamic Client Registration (DCR) or a Client Identifier Metadata Document (CIMD). ChatGPT correctly shows these registration methods as unavailable.
The profile scope is required. Every request to the authorization endpoint must include it, or the request fails.
The seated scope is required for write access. When your OAuth authorization request includes the seated scope, the resulting access token is a seated token. When it does not, the access token is explicitly unseated, and the Write Draft and Publish Draft tools fail with an unseated-user error, even if the signed-in account has a real, paid license seat. Include seated in the scopes that you request if you want to use these tools.

Available tools
The MCP endpoint gives these tools to a connected MCP client:
| Tool | Type | What the tool does |
|---|---|---|
| Search Pages | Read | Performs a full-text search of the pages on your site, and returns the title, path, and a preview of each result |
| Semantic Content Search | Read | Finds the parts of your content that are most related to a question, and returns the correct part of a long article |
| Get Page | Read | Returns the full content of one page via the page ID or the page path |
| Get File | Read | Returns the content of a file that is attached to a page (for example, a PDF or an image) |
| Run Report | Read | Runs a built-in CSV report and returns the data as text. See Reports below. |
| Write Draft | Write | Creates a new page, or changes the draft content of a page |
| Write Draft File | Write | Attaches a file to a draft page, or replaces a file on a draft page |
| Publish Draft | Write | Publishes a draft, which makes the draft the live version of the page |
The write tools use the draft workflow of NiCE KM. New content stays in draft form, and the content is not visible to your readers until you publish it. The MCP client can publish the draft with the Publish Draft tool, or a user can publish the draft manually.
Reports
The Run Report tool runs a built-in CSV report and returns the data as text. The AI client sends two things: the report name, and report parameters (if any).
The following reports are available:
| Report | What it returns | Required parameters | Permissions needed |
|---|---|---|---|
pagedata |
Page data for a search query | q (search query) |
Read access |
page_restrictions |
The restrictions on the pages in a tree | (none) | Admin |
search_queries |
What people search for | (none) | Admin |
users |
The list of users | (none) | Admin |
groups |
The list of groups | (none) | Admin |
user_groups |
A map of users to groups | — | Admin |
Each report checks its own permissions. An AI client can only get a report that the account can already get through the REST API. For example, the users and groups reports need admin access.
If a report is not active on your site, the tool returns an error message that tells you the report is not enabled. Contact your NiCE account rep to enable it.
Troubleshooting
| Symptom | Cause | What to do |
|---|---|---|
| The endpoint returns 403 Forbidden and no tools load | The MCP endpoint is not enabled on your site | Contact your NiCE account rep to enable it |
| Read tools work, but Write Draft or Publish Draft fail with an unseated-user error | The token is unseated | For OAuth, include the seated scope in the authorization request. For a Server API Token, use an account that owns a paid license seat |
| A report returns an error saying it is not enabled | The report is behind a config key that is off | Contact your NiCE account rep to enable it |
| OAuth sign-in fails with a redirect or callback error | The OAuth client's Host does not match the client's callback host | Create an OAuth client whose Host matches the callback host your client uses (for example chatgpt.com for ChatGPT, or localhost for a desktop tool) |
| The client reports the server is unavailable even though the endpoint returns HTTP 200 | The client and server negotiated an incompatible protocol version | Update your MCP client to the latest version and reconnect |
Permissions and security
NiCE KM is a permission-based system. An API key can only see and do the tasks that its user account is permitted to do, and the MCP endpoint does not give more access than the permissions of the account.
- If the account has access to public content only, the search and retrieval tools do not return restricted pages or private pages.
- If the account does not have authoring permissions, the Write Draft tool, the Write Draft File tool, and the Publish Draft tool do not work for that API key.
- If you want the MCP client to only answer questions and not change content, use an account that has neither authoring nor publishing permissions.
The MCP endpoint must be enabled on your site before any MCP client can connect. If the endpoint returns a 403 error, contact your NiCE account rep to enable it.
