Create or edit an OAuth client in Elastic Agent Builder

Switch to the space you want to connect to

Switch to the Kibana space whose agents and tools you want MCP hosts to use. The client works only with that space's MCP server URL, and you can't change its space later.

Open the MCP client management page

1. Find Agents in the navigation menu. You can also search for Agents in the global search bar.
2. In the secondary navigation, select Tools.
3. In the Tools workspace, click Manage all tools.
4. In the Tools library workspace, click Manage MCP, and then select Manage MCP clients (OAuth).
5. Click Add MCP client.

You can also get to this page by searching for Application connections in the global search bar, then selecting Manage MCP clients.

Name the client

Enter a Name. The name is visible to users during the authorization flow, so use something that clearly identifies the application (for example, Claude Desktop — Engineering).

Select a client logo

Optionally set a Client logo to identify the application in the list. Use Select logo to choose from provided options, or select Upload logo to use a custom image.

Selecting a logo is cosmetic, and does not pre-configure any settings.

Set the redirect URI

The redirect URI tells the authorization server where to return the user after they authorize the connection. Select the redirect URI type:

• Local — For applications running on your local machine. The redirect URIs are pre-populated with http://localhost/callback and http://localhost/oauth/callback. Replace or supplement these values to match your Agent's expected callback URL. The authorization server accepts any localhost port, but the path must match exactly.

  Common values:

  • Claude desktop app: http://localhost/oauth/callback
  • Claude Code CLI (native HTTP): http://localhost/callback
  • Cursor (desktop): http://localhost/callback (Cursor uses port 8787, which is accepted automatically)

• Remote — For hosted or cloud-based applications. Enter a single https:// URL. Plain HTTP is not accepted.

  Common values:

  • claude.ai: https://claude.ai/api/mcp/auth_callback

  • Cursor (web/agents): https://www.cursor.com/agents/mcp/oauth/callback

  • ChatGPT: https://chatgpt.com/connector/oauth/{callback_id}

    Warning

    The ChatGPT callback URL is unique to each app. You must start the app creation flow first to get this URL, then return here to add it to your OAuth client.

For local clients that need more than one redirect URI, click Add local URL to add additional URLs.

Optional: Generate a client secret

You can select Generate confidential MCP client (optional) to add a client secret for extra security. This is most useful when your MCP host can store a secret securely, such as a server-side service.

The client secret is displayed after you create the client. The secret is only displayed once and can't be retrieved later.

Save the client

Click Create client. The Copy server details for [client name] dialog displays the values your MCP host (AI agent) needs to authenticate:

• Client ID: The identifier for this client.
• MCP server URL: The endpoint your MCP host uses to reach Elastic Agent Builder tools in this project and space. For a custom space, the URL includes the space ID, for example /s/marketing/api/agent_builder/mcp. Copy the URL exactly as shown, and don't add /s/default to a default-space URL.
• MCP client secret: Appears for confidential clients only. This value is displayed only once and can't be retrieved later, so copy or download it before you close the dialog.

You'll use these values to connect an MCP host.

You can find the client ID and MCP server URL at any time on the MCP clients page. The page lists the project's clients regardless of which space you open it from. Each client's MCP server URL shows the space it works with.