MCP Extensions

Partners may define a configuration for an MCP server that they would like to make available on the Alli platform.

Authorization

Currently, the only supported auth type is oauth2_client_credentials. However, we are always in conversations with our Partners to determine if there are other auth schemes that we should support.

OAuth 2.0 Dynamic Client Registration (DCR) with client_credentials

At the configured auth_server_url, partners must host /.well-known/oauth-authorization-server returning token_endpoint and registration_endpoint. These will be used for OAuth DCR. Partners will need to configure their OAuth servers to validate software_statements signed by the Alli auth server (https://login.alliplatform.com). Alli will mint a signed software_statement and register it at the Partner's OAuth 2.0 registration endpoint. The JWT payload will look something like this:

{
  // JWT registered claims (RFC 7519 §4.1)
  "iss": "https://login.alliplatform.com",
  "aud": "https://auth.partner.com",
  "iat": 1714237200,
  "exp": 1714237500,
  "jti": "ss_01HXYZ7...",

  // DCR client metadata (RFC 7591 §2, used verbatim as JWT claims per §2.3)
  "software_id": "<extension id>",
  "software_version": "<extension version>",
  "client_name": "Alli Platform — <partner>/<extension>",
  "grant_types": ["client_credentials"],
  // software_statements coming from Alli MCP Extensions will be scoped to mcp:invoke
  "scope": "mcp:invoke" 
}

The software_statement can be validated against the signing key at https://login.alliplatform.com/jwks. Alli will use the credentials returned from registration to request tokens via the client_credentials grant at the Partner's token endpoint.

Configuration Example

{
  "mcp": {
    "server_url": "https://partner.example.com/mcp",
    "auth": {
      "type": "oauth2_client_credentials",
      "config": {
        "auth_server_url": "https://auth.partner.com"
      }
    }
  }
}

Request Context

Alli includes the following headers on every proxied MCP request:

Header	Description
X-Alli-Partner-ID	UUID of the partner
X-Alli-Partner-Slug	Partner slug
X-Alli-Extension-ID	UUID of the extension
X-Alli-Extension-Slug	Extension slug
X-Alli-Client-ID	UUID of the Alli client (tenant)
X-Alli-Installation-ID	UUID of the installation

Transport Type

Alli currently supports MCP extensions for MCP servers using streamable HTTP transports.