Skip to main content

Turn on the MCP server

Astrolabe's MCP server lets an AI assistant — Claude Code, VS Code — read your software catalog. Each assistant reads with the rights of the person who connected it, never more, and only reads: it changes nothing in Astrolabe.

You turn it on once, as an administrator. It is off on a new instance.

🔌 Turn on the server​

  1. In the left sidebar, at the bottom, click Administration.

  2. Under PLATFORM, click Plugins.

  3. On the MCP server card, click the switch Enable MCP server. The message MCP server is on appears at the bottom of the screen.

✅ That's it! Each user now finds an MCP card in My Account › My accounts: see Connect your AI assistant.

👀 See and revoke the assistants​

  1. In the left sidebar, at the bottom, click Administration.

  2. Under INTELLIGENCE, click AI assistants. Each assistant people approved shows its person, the day it was approved and the day it last read Astrolabe.

  3. To cut one, click Revoke on its line, then Revoke in the window Revoke this assistant?. The message … can no longer read Astrolabe appears. Its next call is refused; its person can approve it again from the assistant.

The Revoke button needs the right to delete in the administration.

To see what the assistants did, click the Calls tab: each call of the last 30 days shows its person, the tool, when, and Succeeded or Failed with its cause. What an assistant asked and what it was answered are never kept.

🧱 Behind a firewall or Cloudflare Access​

An assistant calls Astrolabe from the user's computer, without a browser: a firewall, a reverse proxy or Cloudflare Access that asks for a sign-in blocks it. Let these addresses of your instance through, for everyone:

PathWhat it is
/api/mcp-actions/The MCP server. Astrolabe itself asks for the user's access on every call.
/api/auth/v1/tokenWhere the assistant exchanges its one-time code for an access.
/.well-known/Where the assistant discovers how to sign in. Nothing secret.
/api/auth/.well-known/Same, for the sign-in service. Nothing secret.

Keep everything else behind your protection: the page where the user approves an assistant opens in their browser, where they are already signed in.

With Cloudflare Access:

  1. In the Cloudflare Zero Trust dashboard, open Access › Applications, then click Add an application › Self-hosted.

  2. Name it, for example Astrolabe MCP.

  3. Click Add public hostname once per path of the table: your Astrolabe domain (for example astrolabe.example.com), and the path without its first slash (api/mcp-actions, api/auth/v1/token, .well-known, api/auth/.well-known).

  4. Add a policy with Action: Bypass and Include: Everyone, then save.

The most precise path wins: the rest of Astrolabe stays behind your usual Access application.

❓ Frequently asked questions​

Can an assistant change something in Astrolabe? No. The MCP server only serves readings of the catalog.

Does an assistant see more than its user? No. It reads with the rights of the person who approved it: what this person cannot see in the catalog, their assistant cannot see either.

Is there anything to configure? No. There is no token to create: each user approves their assistant on an Astrolabe page.

How do I cut every assistant at once? Turn the server off: same switch. Assistants are refused at once, and none can connect again until you turn it back on.

🛠️ Troubleshooting​

The assistant says "Astrolabe's MCP server is turned off by your administrator." The server is off. Turn it on in Administration › Plugins (steps above).

There is no MCP card in My Account › My accounts. Same cause: the server is off.

The assistant cannot connect and mentions a sign-in page, a 302 or a 403 it did not expect. A firewall or Cloudflare Access stands in front of Astrolabe: let the paths of the table through (above).