MCP server

Oblique provides a remote Model Context Protocol (MCP) server that lets you use Oblique from MCP clients such as Claude. The MCP server supports the same operations as the Oblique API and is authorized as your user, or as a service account when you connect with an API key. Both admins and end users can use the MCP server to take actions, like reading current group membership or making access requests.

How the MCP server works

Endpoint

The MCP server endpoint depends on your tenant’s region:

US

https://us.oblique.security/api/mcp/v1

Europe

https://eu.oblique.security/api/mcp/v1

Authentication

Oblique’s MCP server uses streamable HTTP for transport. An MCP client authenticates either as a user, with OAuth 2.0, or as a service account, with an API key.

OAuth

Any Oblique user can create an MCP client connection to Oblique, and the MCP client acts as you, with your permissions in Oblique.

When you connect a client, you can choose the OAuth scope for the connection. The Oblique MCP server supports two scopes:

• Standard: Read all information available to you in Oblique, and create requests.
• Privileged: Read all information available to you in Oblique, and write changes directly.

Authentication automatically expires 14 days after you authorize the client, at which point you will need to reauthenticate. This expiry isn’t configurable.

API keys

A client that many people share, such as an agent installed for your whole organization, is better off not acting as any one user: everyone who uses it would act on that person’s behalf, inheriting their permissions. Connect an agent with an API key instead. The client acts as the API key’s service account, and the API key’s permissions decide what it can do.

The API key is sent as a bearer token in the Authorization header:

Authorization: Bearer my-api-key

Caution

We strongly encourage Assistant permissions for a shared MCP session. Anyone who can use the client can do everything its API key can do. An agent with an Assistant API key can’t see resources that are restricted to specific people, read admin settings, or make changes without a request.

An API key doesn’t expire. To disconnect a client that uses one, revoke the API key.

Caution

You can list access reviews through the MCP server, but can’t complete them.

Audit logs

Actions taken through the MCP server are recorded in Oblique’s audit logs the same way as actions taken in the Oblique app. Each event records the user as the author and the MCP client used as the client. When a client connects with an API key, the API key is the author instead of whoever asked the client to act. You can filter audit logs by client to see all actions taken through MCP.

Connect an MCP client

Claude

In Oblique, select your profile picture in the sidebar, select Account settings, then navigate to the MCP page:

1. Select Add to Claude.
2. In Claude, you will see a dialog to Add custom connector. This is already filled in with the Name and the Remote MCP server URL for the endpoint for your tenant’s region. Select Add.
3. Once the MCP server is added, you will need to connect to it. Select Connect.
4. Select the desired scopes to authorize the MCP server, then select Authorize.

Claude Code

1. In your terminal, run:

   US

   claude mcp add --transport http oblique https://us.oblique.security/api/mcp/v1

   Europe

   claude mcp add --transport http oblique https://eu.oblique.security/api/mcp/v1

2. In Claude Code, run /mcp to see the list of configured MCP servers.

3. Use the arrows to select Oblique.

4. Select Authenticate. Claude Code opens a browser window to authenticate Oblique. Select the desired scopes to authorize the MCP server, then select Authorize.

5. Press enter in your terminal.

Cursor

In Oblique, select your profile picture in the sidebar, select Account settings, then navigate to the MCP page:

1. Select Add to Cursor.
2. In Cursor, under Install MCP Server?, you will see a configuration already filled in with the Name, Type and URL for the MCP server endpoint for your tenant’s region. Select Install.
3. Once the MCP server is added, you will need to connect and authenticate to it. Select Connect.
4. Select the desired scopes to authorize the MCP server, then select Authorize.

Devin

When you install an MCP server for your whole Devin organization, everyone in it shares one connection to Oblique. Connect it with an API key instead of OAuth.

You must be an admin to create an API key.

1. In Oblique, create an API key with Assistant permissions, and copy it.

2. In Devin, in your organization’s settings, navigate to Customizations, then select MCPs.

3. In the Install MCPs for dropdown, change Myself to your organization’s name.

4. Select the plus icon, then select Add custom MCP.

5. Under Server name, enter Oblique.

6. Under Short description, enter:

   Oblique is an access management system that helps users see what work applications they have access to and request new access as needed.

7. Under Connection, in the Transport type dropdown, select HTTP.

8. Under Server URL, enter the endpoint for your tenant’s region:

   US

   https://us.oblique.security/api/mcp/v1

   Europe

   https://eu.oblique.security/api/mcp/v1

9. In the Authentication dropdown, select Authorization header.

10. Under Authorization header, enter Authorization as the header key and Bearer ${API_KEY} as the value. Enter ${API_KEY} as written; you add the API key itself in a later step.

11. Select Add.

12. Select the Oblique MCP server again. It now has a Secrets section.

13. Under Secrets, paste the API key as the value of API_KEY, then select Save secrets.

14. Under Advanced, in the Test tools section, select Test. Devin shows MCP server validation successful when it can reach Oblique.

Note

Requests that Devin creates through a shared connection are created by the API key, not by the person who asked.

Other MCP clients

Any MCP client that supports remote MCP servers with OAuth 2.0 authentication can connect to Oblique. Configure the client with the endpoint for your region, then complete the OAuth flow when prompted.

Caution

ChatGPT only allows adding custom MCP servers in developer mode.

View active MCP sessions

To see which MCP clients are currently connected as you and what scope each was granted, select your profile picture in the sidebar, select Account settings, then navigate to the MCP page. Your connected clients are listed under Your active sessions.

Disconnect an MCP client

An MCP session lives for 14 days from when you authorize the client. The client renews its access token on its own during that time. Once the session expires, the connection will stop working until you reauthenticate.

To disconnect a client before expiry, select your profile picture in the sidebar, select Account settings, navigate to the MCP page, and find the Your active sessions section:

1. Select the More icon on the session you want to disconnect.
2. Select Revoke….
3. Confirm you wish to revoke the session, and select Revoke.

This will invalidate the access token granted to that client, and the client will need to reauthenticate to reconnect.

To remove Oblique’s configuration from the client itself, use the following tool-specific instructions.

Claude

In Claude, you can either disconnect the MCP server (without removing it), or remove it.

To disconnect the MCP server from Claude, navigate to Customize, then Connectors:

1. Find the Oblique connector in your list of connectors, then select it.
2. In the upper right, select Disconnect.
3. In the dialog, confirm that you would like to disconnect the MCP server and select Disconnect.

To remove the MCP server from Claude, navigate to Customize, then Connectors:

1. Find the Oblique connector in your list of connectors, then select it.
2. In the upper right, select the more icon, then select Remove.
3. In the dialog, confirm that you would like to remove the MCP server and select Remove.

Claude Code

In Claude Code, you can either disconnect the MCP server (without removing it), or remove it.

To disconnect the MCP server from Claude Code:

1. In your terminal, run /mcp.
2. Navigate the list of MCP servers using arrow keys to find the Oblique MCP server. Hit enter.
3. To disconnect the MCP server, select Disable.

To remove the MCP server from Claude Code:

1. In your terminal, run claude mcp remove oblique.

Cursor

In Cursor, to remove the MCP server, navigate to Settings then to Plugins:

1. In the list of plugins, find or search for Oblique and select it to open it.
2. In the upper right, select Uninstall.