Connecting a client

Connecting a client

The Subsalt MCP server speaks the Streamable HTTP transport and authenticates with OAuth 2.0. Supported clients must send the required OAuth client ID. Sign-in happens in your browser against your normal Subsalt identity provider — the same login you use for the portal, including SSO — so there is no separate API key to manage.

Endpoint

Point your client at your deployment's MCP endpoint:

https://mcp.<your-subsalt-domain>/mcp

Your exact endpoint hostname is specific to your deployment. If you're not sure what it is, ask your Subsalt administrator or check the Connection details in the Subsalt portal.

The first time a client connects, it opens a browser window for sign-in and authorization. Your client stores and refreshes the resulting token. If a session expires, sign in again. This uses standard OAuth 2.0 discovery (RFC 9728).

---

Claude Code

Add the server from the command line, then authenticate:

claude mcp add --transport http --client-id subsalt-mcp subsalt https://mcp.<your-subsalt-domain>/mcp

Run /mcp inside Claude Code to complete the browser sign-in and confirm the connection is live.

The MCP endpoint requires OAuth and the subsalt-mcp client ID. Clients that cannot configure this client ID are not currently supported.

---

Verifying the connection

Once connected, ask your agent to call the instructions tool. It returns a short getting-started guide and lists the databases available to you — a quick confirmation that authentication succeeded and that your access is what you expect. From there, follow the standard workflow.