The OpenEdge Command Center MCP Server runs separately from the OpenEdge Command Center Server. It accepts MCP client connections over HTTPS on port 8002 by default and connects to the OpenEdge Command Center Server User API on port 8000 by default.

The MCP Server uses mcpConfig.json to define its HTTPS listener, its connection to the OpenEdge Command Center Server, and its certificate settings. The MCP client must be able to reach the MCP Server, and the MCP Server must be able to reach the OpenEdge Command Center Server User API.

The following table lists the configuration settings by section:

  • oecc_mcp defines the MCP Server’s HTTPS listener and incoming client connections.
  • oecc defines the connection to the OpenEdge Command Center Server.
  • The top-level data setting identifies the shared OpenEdge Command Center data directory.
Security field Description
oecc_mcp—MCP Server HTTPS listener
host Specifies the network interface on which the MCP Server listens. The IP address 0.0.0.0 binds the server to all interfaces.
port Specifies the TCP port for incoming client connections. The default is 8002.
key Specifies the path to the private key file securing the MCP Server’s HTTPS listener.
certificate Specifies the path to the TLS certificate presented to connecting clients.
intermediateCertificates Specifies the paths to intermediate CA certificates required to complete the certificate chain, if applicable.
rootCertificates Specifies the paths to trusted root CA certificates used to validate the certificate chain.
keyPassPhrase Specifies the encrypted passphrase that protects the private key file. The passphrase is encrypted automatically on first startup.
allowedHosts Specifies the host names or IP addresses permitted to access the MCP Server.
oecc—Upstream OpenEdge Command Center Server connection settings
host Specifies the host name or IP address of the OpenEdge Command Center Server.
port Specifies the port on which the OpenEdge Command Center Server listens. The default is 8000.
rootCertificates Specifies the paths to trusted root CA certificates used to validate the OpenEdge Command Center Server TLS certificate.
intermediateCertificates Specifies the paths to intermediate CA certificates required to complete the OpenEdge Command Center Server certificate chain, if applicable.
nohostverify Specifies whether to disable host-name verification for the OpenEdge Command Center Server TLS certificate. Set this value to false in production.
requestTimeoutMs Specifies the maximum time, in milliseconds, to wait for a response from the OpenEdge Command Center Server before timing out. The default is 30000 milliseconds (30 seconds).
maxResponseBytes Specifies the maximum response size, in bytes, accepted from the OpenEdge Command Center Server. The default is approximately 5 MB.
Top-level setting
data Specifies the path to the shared OpenEdge Command Center data directory, relative to the configuration file location.

Configure certificates for local and remote access

The OpenEdge Command Center Server installation includes a default set of certificates for communication among OpenEdge Command Center, the MCP Server, Agents, and clients. The default set uses a self-signed root CA, oeccrootca.crt; the MCP Server certificate is signed by this root CA. The default certificate configuration supports local MCP access from localhost.

For production deployments, Progress recommends replacing the certificates supplied with the installation with certificates issued by a certificate authority trusted by your organization. Keep certificate-chain and host-name verification enabled.

Local access with the default certificates

If you keep the default certificate configuration and run the MCP client on the same machine as the MCP Server, install the supplied root CA before starting the MCP Server or connecting from VS Code:

  1. Locate the supplied root CA certificate installer.
  2. Double-click the installer.
  3. Select the certificate installation option and complete the installation.
  4. Start the MCP Server.
  5. In VS Code, connect using the local endpoint configured in mcp.json, with localhost as the host name.

Installing the root CA allows the client to verify the certificate presented by the MCP Server.

Remote access with new certificates

The default certificates are intended for local access and are not suitable for connections from a remote machine. For remote access, generate or obtain a complete new certificate set, including a root CA, server certificates, and MCP Agent certificates. Replace the applicable certificates on the relevant components.

Configure the MCP Server to use the replacement certificate and private key, and update the applicable paths in mcpConfig.json. Add the MCP Server host name or IP address that clients use to connect to the allowedHosts setting under oecc_mcp. The value must match the host used in the client endpoint. For example, if the endpoint uses https://192.0.2.10:8002/mcp, add 192.0.2.10 to allowedHosts.

Install or trust the new root CA on the machine running VS Code. Ensure the MCP Server certificate is valid for the host name or IP address in the client endpoint, and keep certificate-chain and host-name verification enabled. The allowedHosts setting permits requests for the specified host; it does not replace TLS certificate validation.

Restart the MCP Server. In VS Code, update the endpoint in mcp.json to use the remote host name or IP address and configured port, then connect.

If a certificate error prevents the connection, see Troubleshoot OpenEdge Command Center MCP Server connections.