MCP Server

The primedocs MCP server (PrimeDocs.Web.Mcp) is a standalone ASP.NET Core application (.NET 10) that exposes primedocs capabilities to AI agents via the Model Context Protocol. It runs separately from the rest of the primedocs server.

Prerequisites

• .NET 10 Windows Hosting Bundle (same as the primedocs server).
• A reachable primedocs IdentityServer instance for OAuth authorisation.
• A primedocs.config (the same one used by the primedocs server, or one referencing it), see primedocs.config.

Installation

The MCP server is part of the server installation package and runs as its own ASP.NET Core application in IIS (in-process hosting via the ASP.NET Core Module).

• On-premises: The Install.ps1 installation script deploys the MCP application together with the other server applications as an IIS application under the path /mcp (see Installing the primedocs server). The primedocs.config produced by the installation already contains the corresponding apps entry:

  <apps>
    ...
    <add id="[GUID]" name="Mcp" url="https://your-url.example.com/mcp/" logFilePath="Mcp\" type="Mcp" />
  </apps>

• Azure: The MCP application is rolled out via the same ZipDeploy as the rest of the server (see Completing the configuration). For the /mcp path to be reachable, it must be configured as a path mapping of type Application (see App Service › Path Mappings).

Configuration

The MCP server reads its settings from the primedocs.config (the same one used by the primedocs server). In particular, these come from it:

• the IdentityServer URL (authority for JWT bearer and token introspection),
• the MCP base URL from the apps entry of type Mcp,
• the mcpTemplateTagName attribute on the <openAi> element — required for template discovery to work: GetAllTemplates and FindTemplates return only templates carrying that tag (see primedocs AI (Preview)),
• optional values such as the introspection secret and a proxy configuration.

Registering a client for MCP access

For MCP clients (e.g. Microsoft 365 Copilot or Copilot Studio) to sign in via OAuth 2.0, a client with userAuthType="FromLoginForMcp" must be present in the primedocs.config. Any GUID can be used as the id:

<primedocs>
...
  <clients>
    <add id="[GUID]" oidcClientId="McpClient" userAuthType="FromLoginForMcp" />
  </clients>
...
</primedocs>

During dynamic client registration (POST /oauth/register), the server returns the oidcClientId of this entry as the client_id. Without such a client, registration fails with an error. Unusable redirect URIs are rejected with invalid_redirect_uri (HTTP 400) already at registration time — misconfigurations surface early instead of only at authorisation.

The datasource is selected per request via the URL segment (see endpoint).

Endpoint and authentication

The MCP endpoint is tenant-specific — the base URL of the MCP application (/mcp in a standard installation) plus the datasource id:

POST https://{instanz}/mcp/{dataSourceId}

The server is an OAuth 2.0 protected resource. Clients discover the authorisation parameters via the discovery endpoints, which also live below the MCP base URL:

GET https://{instanz}/mcp/.well-known/oauth-protected-resource
GET https://{instanz}/mcp/.well-known/oauth-authorization-server

On a 401 the server returns a WWW-Authenticate header with the resource_metadata URL. Access tokens are validated against the IdentityServer via introspection; the MCP scope is required.

Operation test

To verify the deployment, open the MCP server's base URL (https://your-url.example.com/mcp/) in a browser: a landing page with server information and the tool catalog is displayed.

In addition, the discovery endpoints should return a JSON document without authentication:

https://your-url.example.com/mcp/.well-known/oauth-protected-resource
https://your-url.example.com/mcp/.well-known/oauth-authorization-server

For details on the available tools (GetTemplateStructure, GenerateDocument, GetAllTemplates, FindTemplates), see the MCP interface page.