--- title: Create an MCP client in Agent Builder description: Register an MCP client in Agent Builder to get the credentials and server URL needed to connect an MCP host over OAuth. url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/create-oauth-client products: - Elastic Cloud Serverless - Elastic Observability - Elastic Security - Elasticsearch - Kibana applies_to: - Elastic Cloud Serverless: Preview --- # Create an MCP client in Agent Builder Register a new MCP client in Elastic Agent Builder to generate the credentials that an MCP host, such as Claude Desktop, needs to connect over OAuth 2.1. This is a one-time pre-registration step: OAuth requires each client to be registered with the MCP server before any host can connect or any user can authenticate and consent. Each MCP client is scoped to a single Serverless project. Creating a client gives you a client ID and the MCP server URL for that project. For confidential clients, you also get a client secret that is shown only once and can't be retrieved later. ## Before you begin Before you create an MCP client: - Familiarize yourself with the following concepts: - [Elastic Agent Builder](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/elastic-agent-builder), which provides the tools and agents you'll access. - The [Elastic Agent Builder MCP server](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-server), which exposes those tools to external MCP hosts, and its [authentication methods](/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/mcp-server#mcp-server-authentication). OAuth is one of two ways to authenticate to the MCP server, so confirm it fits your use case. - [MCP clients and the OAuth flow](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/oauth-clients). - Make sure you have **Read** access to the Elastic Agent Builder Kibana feature, which grants access to the MCP client management UI. To learn more, refer to [Permissions](/elastic/docs-content/pull/7104/explore-analyze/ai-features/agent-builder/permissions#kib-privileges). ## Create the client 1. Find **Agents** in the navigation menu. You can also search for **Agent Builder** in the [global search bar](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/explore-analyze/find-and-organize/find-apps-and-objects). 2. Click **Manage components** at the bottom of the left sidebar, then select **Tools**. 3. On the tools library page, click **Manage MCP**, and then select **Manage MCP clients (OAuth)**. 4. Click **Add MCP client**. You can also get to this page from **Admin and settings** → **Application connections** → **Manage MCP clients**. Enter a **Client name**. The name is visible to users during the authorization consent flow, so use something that clearly identifies the application (for example, `Claude Desktop — Engineering`). Optionally set a **Client logo** to identify the application in the list. Use **Select logo** to choose from provided options, or select **Upload logo** to use a custom image.Selecting a logo is cosmetic, and does not pre-configure any settings. The redirect URI tells the authorization server where to return the user after they grant consent. Select the redirect URI type: - **Local** — For applications running on your local machine. The field is pre-populated with `http://localhost:3000/callback`. Replace or supplement this value to match your host's expected path. The authorization server accepts any localhost port, but the path must match exactly. Common values: - Claude Desktop (mcp-remote): `http://localhost:3000/oauth/callback` - Claude Code CLI (native HTTP): `http://localhost:3000/callback` - **Remote** — For hosted or cloud-based applications. Enter a single `https://` URI. Plain HTTP is not accepted. For local clients that need more than one redirect URI, click **Add local URL** to add additional URLs. You can optionally select **Generate confidential MCP client** to add a client secret for extra security. This is most useful when your MCP host can store a secret securely, such as a server-side service.The client secret is displayed after you create the client. The secret is only displayed once and can't be retrieved later. Click **Create client**. The **Copy server details for [client name]** dialog displays the values your MCP host needs to authenticate: - **Client ID**: The identifier for this client. - **MCP server URL**: The endpoint your MCP host uses to reach this project's Elastic Agent Builder tools. - **Client secret**: Appears for confidential clients only. This value is displayed only once and can't be retrieved later, so copy or download it before you close the dialog. You'll use these values to [connect an MCP host](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/connect-mcp-host).The client ID and MCP server URL can be retrieved at any time from the **MCP clients** page. ## Next steps Now that you have the connection information for your MCP client, [configure your MCP host to use it](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/connect-mcp-host). ## Related pages - [OAuth for MCP clients](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/oauth-clients) - [Revoke an MCP client or connection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/revoke-oauth-client) - [Manage application connections](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7104/deploy-manage/app-connections/manage-app-connections)