Connect a universal MCP client

Connect an MCP client to Firezone Cloud US or EU using your account's regional endpoint. For product-specific instructions, see the ChatGPT & Codex or Claude guide.

Before you begin

• You must be an admin of your Firezone account.
• Your MCP client must support Streamable HTTP, OAuth authorization code flow with PKCE (S256), and OAuth Client ID Metadata Documents (CIMD). Firezone does not provide dynamic client registration.

The AI & MCP overview lists authentication requirements, permissions, and supported operations.

Add the MCP server

1. Open your client's MCP server settings and add a remote server named firezone.

2. Select Streamable HTTP as the transport.

3. Enter the URL for your account's region:

   Region	MCP server URL
   Firezone Cloud US	https://rest-api.firezone.dev/mcp
   Firezone Cloud EU	https://eu.rest-api.firezone.dev/mcp

4. Save the server configuration and start the client's OAuth connection flow.

Authorize the connection

1. Check that the browser opens app.firezone.dev for Firezone Cloud US or eu.app.firezone.dev for Firezone Cloud EU.
2. Enter your account slug if prompted, then sign in with your usual method.
3. Review the permissions on the consent screen. Select write permissions only for the operations you want the assistant to perform.
4. Select Connect and return to your MCP client.

You do not need to create an OAuth client or an API token in Firezone. If the client requests dynamic registration or a REST API token, check that it supports Firezone's OAuth flow.

Verify the connection

Ask the assistant to list your Firezone Sites, then compare the result with the admin portal. If the server connects but an operation is unavailable, check the granted scopes.

If sign-in opens the wrong regional portal, check the MCP URL and reconnect using the endpoint for your account's region.

Disconnect the client

1. In the Firezone admin portal, select your user avatar in the upper right, then select Your settings.
2. Under Connected apps, find the connection and select Disconnect.

Credentials created through the connection remain valid after disconnection. Revoke any Client or Gateway tokens you no longer need separately.

Need help? See all support options.