Docs

Configure the Glean MCP Server

Updated 3 min read

Overview

Glean operates an official hosted, tenant-specific MCP server exposing enterprise search and assistant tools — search, chat, read_document, employee_search, user_activity, and the cross-session memory/memory_schema pair — backed by everything Glean has indexed for your tenant, including Drive, Confluence, Slack, Jira, Gmail or Outlook, GitHub, Salesforce, Gong, and HR systems. Access is authorized through OAuth, generally via dynamic client registration (DCR).

1. Configure Glean

  1. Sign in to Glean as a workspace or platform administrator and open the MCP Configurator (in app.glean.com, under Settings → Install, look for Configure MCP) or the equivalent MCP/Agents section of the admin console.
  2. Confirm your tenant’s MCP endpoint from the configurator. Glean hosts its managed MCP server per customer at a tenant-specific backend host, generally of the form https://<your-company>-be.glean.com/mcp/<endpoint> (for example, a default endpoint exposing search, chat, and read_document). Copy the exact host and endpoint path the configurator shows for your instance, since the subdomain is unique per customer and the available endpoint names can vary by Glean release.
  3. Leave dynamic client registration (DCR) enabled if your tenant allows it — this is Glean’s usual path for MCP hosts, including gateways, and lets your Dtwo gateway register itself with Glean’s OAuth server automatically on first connect.
  4. If your tenant admin has restricted DCR to an approved allowlist or turned it off, pre-register an OAuth client for the gateway instead, from the same MCP/Agents admin area: create the client, then record the client ID, client secret (shown once), and the tenant’s OAuth token endpoint. Add your Dtwo gateway to the DCR allowlist if that’s the restriction in place, rather than disabling DCR tenant-wide.

2. Add the MCP server to your gateway config

In the mcp_servers section of your gateway configuration add the following entry:

  - name: glean
    description: "Glean enterprise search — aggregates Drive, Confluence, Slack, Jira, email, GitHub, Salesforce, Gong, and HR data behind search/chat/read_document/memory tools."
    url: "https://<your-company>-be.glean.com/mcp/<endpoint>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - default
      issuer: "https://<your-company>-be.glean.com"
      redirect_uri: "<CALLBACK_URL>"

If your tenant admin has restricted or disabled dynamic client registration, replace issuer with the client credentials from the OAuth app you pre-registered in step 1.4 instead:

  - name: glean
    description: "Glean enterprise search — aggregates Drive, Confluence, Slack, Jira, email, GitHub, Salesforce, Gong, and HR data behind search/chat/read_document/memory tools."
    url: "https://<your-company>-be.glean.com/mcp/<endpoint>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - default
      client_id: "<GLEAN_CLIENT_ID>"
      client_secret: "<GLEAN_CLIENT_SECRET>"
      token_url: "https://<your-company>-be.glean.com/oauth/token"
      redirect_uri: "<CALLBACK_URL>"

Replace the placeholder values:

  • <your-company> and <endpoint> — the tenant host and endpoint path you confirmed in step 1.2, wherever they appear in url, issuer, and token_url.
  • <GLEAN_CLIENT_ID> and <GLEAN_CLIENT_SECRET> — come from the OAuth client you registered in step 1.4, if DCR is restricted.
  • <CALLBACK_URL> — your Dtwo gateway’s OAuth callback URL, found in the Configuration section for your gateway in the Dtwo UI.

3. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize Glean via the gateway. This opens Glean’s login screen — sign in as the user whose permissions the agent should inherit, and approve the consent prompt. Once authorized, confirm the glean-* tools appear and run a quick call, such as glean-search with a narrow query, to make sure the connection works.

Having trouble? Email support@dtwo.ai.