Using the MCP server from your own client
How to connect an MCP-aware AI client to the Seal MCP server.
Any MCP-aware client can connect to the Seal MCP server. The Seal-specific values are below; everything else follows the standard OAuth-protected MCP setup for your client.
What you need
The Seal MCP server URL, from your tenant's API page in the Seal UI.
The user's Seal credentials, used in the OAuth flow.
An MCP client that supports OAuth-protected MCP servers (Claude Code, Cursor, Claude Desktop with
mcp-remote, or a custom MCP client).
Adding Seal from the MCP registry
Seal is listed in the official MCP registry as io.sealsecurity/mcp. Clients that browse the registry can add Seal from their server directory rather than being handed a URL; the listing points at Seal's hosted MCP endpoint over the streamable-http transport. Authentication is unchanged; the OAuth flow still runs on first connect.
Not every MCP client browses the registry. If yours does not, set the server URL manually.
Configuring a client
Each MCP client has its own configuration mechanism for adding a remote MCP server. Set:
Server URL: the Seal MCP server URL from your tenant.
Transport: HTTP. Clients that only speak stdio reach Seal through a local bridge such as
mcp-remote.Auth mode: OAuth.
During the flow, Seal shows a consent page naming the client requesting access. Select Allow to grant, Deny to abort. Subsequent restarts reuse the stored tokens until they expire or are revoked.
Verifying the connection
Ask the client to list Seal's tools. The list should match the Tool catalog. A quick smoke test: ask the client to call list_projects against Seal.
Troubleshooting
OAuth flow fails or stalls. Confirm the MCP server URL and that your network can reach Seal's identity provider. Some restricted networks block the required OAuth endpoints; allow-list them per the Network requirements.
Tool list is empty. Likely an auth issue; re-authenticate. If it persists, contact your Seal account team.
A tool you expected is missing. The tool may sit behind a tenant feature flag; contact your Seal account team.
A call returns "permission denied". The calling user lacks the required permission. Use an account with the right role, or scope the workflow to tools the user can call.
Related
Last updated