skills.rest
curtismu7
curtismu7COMMUNITY
Explore all skills by this author →
GitHub

pingone-remote-mcp-connect

Connects IDE MCP clients to the PingOne hosted Remote MCP Server via OAuth.

1|Updated Jun 25, 2026
Search Tags:#oauth#claude code#mcp#identity management#pkce#pingone#worker app
One-click install
npx skills add https://github.com/curtismu7/AI-DEMO2 --skill pingone-remote-mcp-connect-curtismu7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pingone-remote-mcp-connect
Source: https://github.com/curtismu7/AI-DEMO2/tree/main/.claude/skills/pingone-remote-mcp-connect
Command: npx skills add https://github.com/curtismu7/AI-DEMO2 --skill pingone-remote-mcp-connect-curtismu7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Setting up IDE MCP clients (Claude Code, Cursor, VS Code, GitHub Copilot) against PingOne's hosted Remote MCP Server involves OAuth app configuration, redirect URI rules, role-based tool visibility, and subtle failure modes that are hard to diagnose without a guided procedure. ## Core Features & Use Cases - Worker App Setup: Step-by-step creation of a public OAuth Worker application in the PingOne admin console with Authorization Code + PKCE (S256) and the correct redirect URIs for port 7474 callbacks. - Client Connection Guides: Concrete configuration for Claude Code (claude mcp add), Cursor (mcp.json), and VS Code/Copilot against https://mcp.pingone.com/admin/{envId}/mcp. - Troubleshooting Matrix: Ordered diagnostics for common failures such as wrong app type (NATIVE_APP vs WORKER), stale cached tokens, silent SSO hijack, missing feature flags, and role-based tool visibility. - Use Case: A developer sees only ~6 PingOne tools with every call denied; the skill identifies the app type as the root cause and walks through recreating it as a Worker app and clearing the cached token. ## Quick Start Connect my Claude Code client to the PingOne Remote MCP Server using my environment ID and Worker app client ID.

Frequently Asked Questions about pingone-remote-mcp-connect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect Claude Code to the PingOne Remote MCP Server?▼

Run `claude mcp add --transport http --client-id {clientId} --callback-port 7474 pingone https://mcp.pingone.com/admin/{envId}/mcp` with your Worker app client ID and environment ID, then authorize when prompted. The Worker app must use Authorization Code grant with PKCE S256 and the redirect URI http://127.0.0.1:7474/callback.

How do I configure a PingOne Worker app for MCP client authentication?▼

In the PingOne admin console, create a Worker application with grant types Authorization Code and Refresh Token, PKCE enforcement S256_REQUIRED, Token Endpoint Authentication Method set to None (Public Client), and redirect URIs http://127.0.0.1:7474/callback or http://127.0.0.1/* for VS Code.

Why does the PingOne MCP server only show a few tools with every call denied?▼

The most common cause is the OAuth app being a NATIVE_APP or WEB_APP instead of a WORKER, which limits tokens to self-service scopes regardless of admin roles. App type is immutable, so delete the app and recreate it as a Worker, then clear the cached token and re-authenticate.

What admin roles are needed to see all PingOne Remote MCP tools?▼

PingOne admin tools require the Environment Admin role, and DaVinci tools require the DaVinci Admin role. After changing a user's admin roles, disconnect and reconnect the MCP client so the tools/list reflects the new role set.

Why does MCP re-authentication succeed without showing a login form?▼

This is silent SSO hijack: the browser holds another user's PingOne session in the same environment, so no credential prompt appears. Use an incognito window or sign in as a different user; seeing a credential prompt is the success signal.

Can I use local PingOne or DaVinci MCP servers alongside the remote server?▼

No, you should disable any existing local PingOne or DaVinci MCP servers in the same workspace before enabling the remote server. Running both causes duplicate or conflicting tools in the client.

Related Skills

Explore More Software Engineering Skills→
automateyournetworkautomateyournetwork
650

zscaler-identity

Manage Zscaler users, groups, departments, and identity provider configurations via OneAPI.

Community
Basic
Within-7Within-7

mcp-minimal

Connect to remote MCP services over SSE and discover tools.

Official
Basic
curtismu7curtismu7

pingone-session-termination

Deletes server-side PingOne SSO session records to prevent silent re-authentication.

Community
Advanced
LAF-USLAF-US

building-mcp-server-on-cloudflare

Create and secure an MCP server on Cloudflare Workers with OAuth.

Official
Advanced