> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/mcp-server/using-from-your-client.md).

# Using the MCP server from your own client

How to connect an MCP-aware AI client to Seal's MCP server.

Any MCP-aware client can connect. The Seal-specific values are below; everything else follows the standard OAuth-protected MCP setup for your client.

## What you need

* The server URL: `https://mcp.sealsecurity.io/mcp`.
* The user's Seal credentials, used in the OAuth flow.
* An MCP client that supports OAuth-protected MCP servers (Claude Code, Cursor, Claude Desktop with `mcp-remote`, or a custom MCP client).

## Adding from the MCP registry

Seal is listed in the [official MCP registry](https://registry.modelcontextprotocol.io) as `io.sealsecurity/mcp`. Clients that browse the registry can add Seal from their server directory rather than being handed a URL; the listing points at Seal's hosted MCP endpoint over the `streamable-http` transport. Authentication is unchanged; the OAuth flow still runs on first connect.

## Configuring a client

Each MCP client has its own configuration mechanism. Set:

* **Server URL:** `https://mcp.sealsecurity.io/mcp`.
* **Transport:** HTTP. Clients that only speak stdio reach Seal through a local bridge such as `mcp-remote`.
* **Auth mode:** OAuth. You sign in with your Seal credentials, the same way you sign in to the Seal UI.

During the flow, Seal shows a consent page naming the client requesting access. Select **Allow** to grant, **Deny** to abort. Subsequent restarts reuse the stored tokens until they expire or are revoked.

Local MCP clients often pick a fresh port each launch. Following [RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252), the server accepts any port on a loopback redirect URI (`localhost`, `127.0.0.1`, or `::1`), so those clients connect without pinning a port.

## Verifying the connection

Ask the client to list Seal's tools. The list should match the [Tool catalog](/reference/mcp-server/tool-catalog.md). A quick smoke test: ask the client to call `list_projects` against Seal.

## Troubleshooting

* **OAuth flow fails or stalls.** Confirm the MCP server URL and that your network can reach the Seal OAuth endpoints listed in [Network requirements](/reference/network-requirements.md). Restricted networks sometimes block them.
* **Tool list is empty.** Likely an auth issue; re-authenticate. If it persists, contact your Seal account team.
* **A tool you expected is missing.** The tool may sit behind a tenant feature flag; contact your Seal account team.
* **A call returns "permission denied".** The calling user lacks the required permission. Use an account with the right role, or scope the workflow to tools the user can call.

## Related

* [What the MCP server is](/reference/mcp-server/what-it-is.md)
* [Tool catalog](/reference/mcp-server/tool-catalog.md)