# Configure the Glean MCP Server

Connect Glean's official hosted MCP server to a Dtwo gateway via OAuth.

## Overview

Glean operates an official hosted, tenant-specific MCP server exposing enterprise search and assistant tools — `search`, `chat`, `read_document`, `employee_search`, `user_activity`, and the cross-session `memory`/`memory_schema` pair — backed by everything Glean has indexed for your tenant, including Drive, Confluence, Slack, Jira, Gmail or Outlook, GitHub, Salesforce, Gong, and HR systems. Access is authorized through OAuth, generally via dynamic client registration (DCR).

## 1. Configure Glean

1. Sign in to Glean as a workspace or platform administrator and open the MCP Configurator (in <a href="https://app.glean.com" target="_blank" rel="noopener noreferrer">app.glean.com</a>, under **Settings → Install**, look for **Configure MCP**) or the equivalent MCP/Agents section of the admin console.
2. Confirm your tenant's MCP endpoint from the configurator. Glean hosts its managed MCP server per customer at a tenant-specific backend host, generally of the form `https://<your-company>-be.glean.com/mcp/<endpoint>` (for example, a default endpoint exposing `search`, `chat`, and `read_document`). Copy the exact host and endpoint path the configurator shows for your instance, since the subdomain is unique per customer and the available endpoint names can vary by Glean release.
3. Leave dynamic client registration (DCR) enabled if your tenant allows it — this is Glean's usual path for MCP hosts, including gateways, and lets your Dtwo gateway register itself with Glean's OAuth server automatically on first connect.
4. If your tenant admin has restricted DCR to an approved allowlist or turned it off, pre-register an OAuth client for the gateway instead, from the same MCP/Agents admin area: create the client, then record the **client ID**, **client secret** (shown once), and the tenant's OAuth token endpoint. Add your Dtwo gateway to the DCR allowlist if that's the restriction in place, rather than disabling DCR tenant-wide.

## 2. Add the MCP server to your gateway config

Go to your gateway in the Dtwo UI and open **Configuration → Advanced**. In the `mcp_servers` section add the following entry:

```yaml
  - name: glean
    description: "Glean enterprise search — aggregates Drive, Confluence, Slack, Jira, email, GitHub, Salesforce, Gong, and HR data behind search/chat/read_document/memory tools."
    url: "https://<your-company>-be.glean.com/mcp/<endpoint>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - default
      issuer: "https://<your-company>-be.glean.com"
      redirect_uri: "<CALLBACK_URL>"
```

If your tenant admin has restricted or disabled dynamic client registration, replace `issuer` with the client credentials from the OAuth app you pre-registered in step 1.4 instead:

```yaml
  - name: glean
    description: "Glean enterprise search — aggregates Drive, Confluence, Slack, Jira, email, GitHub, Salesforce, Gong, and HR data behind search/chat/read_document/memory tools."
    url: "https://<your-company>-be.glean.com/mcp/<endpoint>"
    transport_type: streamablehttp
    authentication:
      type: oauth
      grant_type: authorization_code
      scopes:
        - default
      client_id: "<GLEAN_CLIENT_ID>"
      client_secret: "<GLEAN_CLIENT_SECRET>"
      token_url: "https://<your-company>-be.glean.com/oauth/token"
      redirect_uri: "<CALLBACK_URL>"
```

Replace the placeholder values:

- `<your-company>` and `<endpoint>` — the tenant host and endpoint path you confirmed in step 1.2, wherever they appear in `url`, `issuer`, and `token_url`.
- `<GLEAN_CLIENT_ID>` and `<GLEAN_CLIENT_SECRET>` — come from the OAuth client you registered in step 1.4, if DCR is restricted.
- `<CALLBACK_URL>` — your Dtwo gateway's OAuth callback URL, found in the Overview tab for your gateway in the Dtwo UI.

## 3. Deploy and verify

Save the configuration and deploy the gateway.

Then, in your AI client, ask it to authorize Glean via the gateway. This opens Glean's login screen — sign in as the user whose permissions the agent should inherit, and approve the consent prompt. Once authorized, confirm the `glean-*` tools appear and run a quick call, such as `glean-search` with a narrow query, to make sure the connection works.

If the tools don't appear after you authorize, refresh the tool list in your AI client — some clients don't pick it up automatically.

---

Having trouble? Email [support@dtwo.ai](mailto:support@dtwo.ai).