Skip to content

Application connections tech preview (A.K.A. MCP OAuth)#7104

Merged
shainaraskas merged 20 commits into
mainfrom
mw-oauth
Jul 16, 2026
Merged

Application connections tech preview (A.K.A. MCP OAuth)#7104
shainaraskas merged 20 commits into
mainfrom
mw-oauth

Conversation

@shainaraskas

@shainaraskas shainaraskas commented Jun 24, 2026

Copy link
Copy Markdown
Member

What this adds

Docs for connecting MCP hosts to the agent builder MCP server with OAuth, alongside the existing API key method.

New pages:

Also: split API key setup into its own MCP server API keys page and trimmed MCP server to an overview plus an auth method comparison. Minor crosslink, terminology, and permissions updates.

How it's organized, and why

  • Setup and concepts live under Application connections in Deploy & Manage, since app connections are a Cloud/org concept and the org-level view is in the Cloud Console. This will allow the concepts to be easily expanded upon when we roll out support for CLI OAuth etc.
  • The MCP server itself and the OAuth vs. API keys comparison stay in Agent Builder docs, where the feature lives. I'll also be crosslinking the OAuth page below the mcp server page in agent builder, but can't do that until after this merges due to tooling limitations
  • One overview page on top, task pages (create, connect, revoke) beneath it.

Open questions

  • Read-only or read-write tools in preview? PRD says read-only ES|QL; QA showed write tools. Affects the OAuth and MCP server pages.
  • Retention windows for revoked connections (3 months?) and clients (1 year?) — unconfirmed.
  • Is Cursor supported in preview? (cp-iam-team#2974)
  • Programmatic client creation API endpoint link, once public. (cp-iam-team#2429)
  • "Connected by" for removed org members — shows email, falls back to user ID; former-member behavior unconfirmed. (kibana#98260, cp-iam-team#2933)

Generative AI disclosure

  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?
  • Yes
  • No
  1. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used: opus 4.8 plus a lot of elbow grease

@github-actions

github-actions Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Elastic Docs Style Checker (Vale)

Summary: 3 warnings, 2 suggestions found

⚠️ Warnings (3): Fix when the suggestion improves clarity or correctness.
File Line Rule Message
deploy-manage/app-connections/connect-mcp-host.md 29 Elastic.DontUse Don't use 'just'.
deploy-manage/app-connections/oauth-clients.md 59 Elastic.Spelling 'revalidated' is a possible misspelling.
explore-analyze/ai-features/agent-builder/mcp-server-api-keys.md 73 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'VS'.
💡 Suggestions (2): Optional style improvements. Apply when helpful.
File Line Rule Message
deploy-manage/_snippets/app-connection-permissions.md 3 Elastic.Semicolons Use semicolons judiciously.
explore-analyze/ai-features/agent-builder/mcp-server-api-keys.md 34 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@github-actions

Copy link
Copy Markdown
Contributor

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

  • Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

@shainaraskas shainaraskas changed the title stand up marci mcp docs Application connections tech preview Jul 2, 2026
@shainaraskas

Copy link
Copy Markdown
Member Author

todo: disambiguation note on elasticsearch://reference/search-connectors/index.md

@shainaraskas
shainaraskas marked this pull request as ready for review July 3, 2026 22:40
@shainaraskas
shainaraskas requested review from a team as code owners July 3, 2026 22:40
@shainaraskas shainaraskas changed the title Application connections tech preview Application connections tech preview (A.K.A. MCP OAuth) Jul 3, 2026
@shainaraskas
shainaraskas requested a review from leemthompo July 3, 2026 22:47
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
@akm-esco

akm-esco commented Jul 7, 2026

Copy link
Copy Markdown

@leemthompo FYI, this would be good to include in the Agent Builder docs section as well

@leemthompo

Copy link
Copy Markdown
Member

@akm-esco yep that's tracked as part of this work:

The MCP server itself and the OAuth vs. API keys comparison stay in Agent Builder docs, where the feature lives. I'll also be crosslinking the OAuth page below the mcp server page in agent builder, but can't do that until after this merges due to tooling limitations

Co-authored-by: Alex Chalkias <34575586+alxchalkias@users.noreply.github.com>
@leemthompo

leemthompo commented Jul 13, 2026

Copy link
Copy Markdown
Member

FYI: opened #7329 as a temporary hidden stub for so elastic/kibana#277286 can link to a live URL while this full docs PR is still in progress.

leemthompo added a commit that referenced this pull request Jul 13, 2026
## Summary

Adds a temporary hidden stub for
/deploy-manage/app-connections/oauth-clients so elastic/kibana#277286
can link to a live docs URL before the full OAuth/application
connections docs in #7104 merge.

## Changes

- Adds a hidden TOC entry for
deploy-manage/app-connections/oauth-clients.md.
- Adds a minimal page with front matter and the oauth-clients anchor
only.

## Follow-up

Replace this stub with the full content from #7104 when that PR is
ready.
@shainaraskas

shainaraskas commented Jul 15, 2026

Copy link
Copy Markdown
Member Author

@jakelandis I've done a pass of your comments and this is ready for another review.

Re: "MCP client/server" vs. "OAuth client/server" terminology, I'm a bit confused about the intended term and could use a clarification.

Some of the suggestions change "MCP client" to "OAuth client," like the Key concepts row and "creates an OAuth client", but a few spots still say "MCP client" for what looks like the same thing, like "Register a new MCP client" on the create page and "MCP clients can also be created through the Kibana API". The App connection row ends up using both in one sentence.

I also wasn't sure how this should line up with the UI, which says Add MCP client and Manage MCP clients (OAuth), since the steps reference those labels.

Can you tell me which term you want where? Mainly: what should the thing you create in Kibana be called in the docs, and should I match the UI labels in the task steps or use the new term everywhere?

@shainaraskas
shainaraskas requested a review from jakelandis July 15, 2026 20:14
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
@jakelandis

jakelandis commented Jul 15, 2026

Copy link
Copy Markdown

Re: "MCP client/server" vs. "OAuth client/server" terminology, I'm a bit confused about the intended term and could use a clarification.

MCP client is a technical concept and the user never directly interacts with it. The MCP client is the technical code/library used inside of an MCP host such as Claude Code. It's the technical bits that know how to talk to an MCP server.

OAuth client has 2 meanings.

  1. Much like the MCP client it can refer to the technical bits that talk to an OAuth server. However in this definiton all fully spec'd MCP clients are also OAuth clients since MCP uses OAuth. So in this technical definition, MCP clients are a superset of OAuth clients that know MCP and OAuth.
  2. The second less technical meaning for OAuth client is the one I mean. You create an OAuth client via the Kibana UI. That "client" is the anchor by which all access is derived. Today, you can only use an OAuth client for the purposes of MCP, but in the near future, OAuth can be used outside of MCP.

I also wasn't sure how this should line up with the UI, which says Add MCP client and Manage MCP clients (OAuth), since the steps reference those labels.

I missed that copy .. it is technically wrong (I am being very pedantic) ...but I think it is abit more forgivable given the context of the application. We don't want to oversell how far that what you configure will work. It is technically an OAuth client that today only works with this exact MCP server.

All said, I am being very pedantic and not very consistent and it probably doesn't matter that much. Moving the UI/UX outside of MCP to be more general OAuth (with MCP or without MCP) is on the very near roadmap, so I expect these docs and UI to change fairly soon. Using OAuth client is tiny bit more correct and future proof.

@jakelandis jakelandis left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Thanks ! These are really good!

Comment thread deploy-manage/app-connections/create-oauth-client.md Outdated

@wajihaparvez wajihaparvez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Admin stuff LGTM! 👏
No blockers, just some suggestions

Comment thread deploy-manage/app-connections/create-oauth-client.md
Comment thread deploy-manage/app-connections/manage-app-connections.md Outdated
Comment thread deploy-manage/app-connections/manage-app-connections.md Outdated
Comment thread deploy-manage/app-connections/manage-app-connections.md Outdated
Comment thread deploy-manage/app-connections/oauth-clients.md Outdated
Comment thread deploy-manage/app-connections/oauth-clients.md Outdated
Comment thread deploy-manage/app-connections/revoke-oauth-client.md
Comment thread deploy-manage/app-connections/revoke-oauth-client.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/manage-app-connections.md Outdated

@eedugon eedugon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Such a complex PR and topic!
Great work, just adding some comments and suggestions for discussion.

Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/app-connections/connect-mcp-host.md Outdated
Comment thread deploy-manage/_snippets/app-connection-permissions.md Outdated
Comment thread deploy-manage/_snippets/app-connection-permissions.md Outdated
@shainaraskas
shainaraskas requested a review from a team as a code owner July 16, 2026 15:32

@leemthompo leemthompo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm (with some minor macro suggestions shared in slack) 🚀

@shainaraskas
shainaraskas merged commit 7d88bac into main Jul 16, 2026
8 checks passed
@shainaraskas
shainaraskas deleted the mw-oauth branch July 16, 2026 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants