When OpenEdge Command Center uses local authentication, create and manage personal access tokens through the OpenEdge Command Center APIs. PAT management is not performed through the MCP Server. You can use Swagger to call the APIs.

Create a PAT

To create a PAT, you need to send a POST request to /api/pat endpoint by providing the following request fields:

  • name: Required. A name that identifies the PAT.
  • description: Optional. A description of how the PAT will be used.
  • expiresInDays: Specify the PAT lifetime in days, as supported by the API.

When the PAT is created, the API returns the PAT. Copy it immediately and store it securely. The PAT is not displayed again after the creation response. Do not store the PAT in documentation, source control, screenshots, or log files.

A PAT uses the roles and permissions of the user who created it. The MCP client can therefore access only the OpenEdge Command Center information that the PAT owner is authorized to view.

Revoke a PAT

To revoke a PAT, you can send a DELETE request to /api/pat/<patId> endpoint. Replace <patId> with the identifier of the PAT to revoke. Revocation prevents the PAT from being used for a new MCP connection.

Respond to an exposed PAT

Treat an exposed PAT as compromised. Do not continue using it.

  1. Revoke the PAT through the OpenEdge Command Center API:

    DELETE /api/pat/<patId>

    Replace <patId> with the identifier of the exposed PAT.

  2. Remove the exposed PAT from the MCP client configuration and any other location where it was stored.
  3. Review where the PAT was exposed and remove it from those locations where possible.
  4. Create a replacement PAT through the OpenEdge Command Center API:

    POST /api/pat

  5. Copy the new PAT from the creation response and store it securely.
  6. Update the MCP client configuration with the new PAT.
  7. Reconnect the MCP client and run a read-only request to verify the connection.

PAT creation, revocation, and authentication are performed through OpenEdge Command Center APIs. The MCP Server does not provide tools for creating, listing, updating, or revoking PATs.

Connect an MCP client with a PAT

Use the following configuration when OpenEdge Command Center uses local authentication. The MCP Server listens on port 8002 by default. If the port was changed, use the value specified by port under the oecc_mcp section in mcpConfig.json.

{
  "servers": {
    "oecc_mcp": {
      "type": "http",
      "url": "https://<mcp-server-host>:<mcp-server-port>/mcp",
      "headers": {
        "Authorization": "Bearer <Personal Access Token>"
      }
    }
  }
}

Replace <mcp-server-host> with the MCP Server host name or IP address, <mcp-server-port> with the configured MCP Server port, and <Personal Access Token> with the PAT created through the OpenEdge Command Center APIs.

Here, the server name oecc_mcp is an example. You can use another name for the server entry. Save the mcp.json file. Reload or refresh the MCP configuration if required by the MCP client.

Connect and verify the client

  1. Start or connect to the server entry configured in mcp.json.
  2. Wait for the MCP client to report that the MCP Server is connected.
  3. Run the following read-only request:
    List the OpenEdge Command Center databases that I am authorized to view.

The MCP Server returns only the databases that the PAT owner is authorized to view.