Configure MCP clients for the Boundary MCP server

You can configure an MCP client to connect to a running Boundary MCP server.

Public preview

Public preview functionality is stable, but possibly incomplete and subject to change. We strongly discourage using preview features in production deployments of Boundary.

The Boundary MCP server uses the Streamable HTTP transport. Your MCP client connects to a randomly assigned port by default. You can manually set the address to a specific port, or refer to the server logs to find the port the operating system assigned.

You have two options for how to supply credentials:

Environment-based setup (binary only): Start the binary with the Boundary address and token in its process environment. Clients need only a URL. No headers are required.
Client configuration: Each client passes the token and address as HTTP headers on every request. Use this approach when running the server with Docker, or when different clients need to connect as different Boundary users.

Requirements

A running Boundary MCP server. Refer to Run the Boundary MCP server for instructions.
A Boundary token for the user connecting from this client. The controller enforces role-based access control on every request using this token, so use a token with only the permissions that user needs. Refer to Permissions in Boundary for more information.
Your Boundary controller address, for example https://cluster.boundary.hashicorp.cloud:9200.

Environment-based setup (binary only)

In local mode, you can start the binary with the Boundary address and token set in the binary's process environment. The server uses those values as a fallback so clients only need to supply a URL.

$ export BOUNDARY_ADDR=https://cluster.boundary.hashicorp.cloud:9200
$ export BOUNDARY_TOKEN=$(boundary config get-token)
$ boundary-mcp-server --addr 127.0.0.1:8080

Then configure your MCP client with the server URL:

{
  "servers": {
    "boundary": {
      "type": "streamable-http",
      "url": "http://127.0.0.1:8080"
    }
  }
}

Because the token is fixed when the server starts, every client of that process acts as the same identity. You must restart the server when the token expires. A BOUNDARY_TOKEN or BOUNDARY_ADDR header sent by a client still takes precedence over these values.

Client configuration

Select your MCP client and add the configuration to its settings file. Replace <<BOUNDARY_TOKEN_HERE>> with your Boundary token and <<BOUNDARY_ADDR_HERE>> with your Boundary controller address.

Add the following configuration to your Bob MCP settings. Refer to Using MCP in Bob for the location of the settings file.

{
  "mcpServers": {
    "boundary": {
      "type": "streamable-http",
      "url": "http://localhost:8080",
      "headers": {
        "BOUNDARY_TOKEN": "<<BOUNDARY_TOKEN_HERE>>",
        "BOUNDARY_ADDR": "<<BOUNDARY_ADDR_HERE>>"
      },
      "disabled": false
    }
  }
}

Note

IBM Bob does not support environment variable references or prompted input in MCP settings. You must enter your Boundary token directly in the headers section of the configuration. Because the token is stored as plain text, do not commit the settings file to version control or share it with other users.

You can configure the server in your user settings or in a workspace settings file.

User settings

Press Ctrl+Shift+P, type Preferences: Open User Settings (JSON), and add the following configuration. Refer to the VS Code MCP documentation for more information.

{
  "mcp": {
    "servers": {
      "boundary": {
        "type": "streamable-http",
        "url": "http://localhost:8080",
        "headers": {
          "BOUNDARY_TOKEN": "${input:boundary-token}",
          "BOUNDARY_ADDR": "${input:boundary-addr}"
        }
      }
    },
    "inputs": [
      {
        "type": "promptString",
        "id": "boundary-token",
        "description": "Boundary API Token",
        "password": true
      },
      {
        "type": "promptString",
        "id": "boundary-addr",
        "description": "Boundary Controller Address (for example, https://cluster.boundary.hashicorp.cloud:9200)",
        "password": false
      }
    ]
  }
}

Workspace settings

To share the configuration with your team, create a .vscode/mcp.json file in your workspace and add the following configuration:

{
  "servers": {
    "boundary": {
      "type": "streamable-http",
      "url": "http://localhost:8080",
      "headers": {
        "BOUNDARY_TOKEN": "${input:boundary-token}",
        "BOUNDARY_ADDR": "${input:boundary-addr}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "boundary-token",
      "description": "Boundary API Token",
      "password": true
    },
    {
      "type": "promptString",
      "id": "boundary-addr",
      "description": "Boundary Controller Address (for example, https://cluster.boundary.hashicorp.cloud:9200)",
      "password": false
    }
  ]
}

After you add the configuration, open Copilot Chat and switch to Agent mode to use the MCP server.

Add the following configuration to ~/.cursor/mcp.json, or open Settings → Cursor Settings → MCP and add it there. Refer to the Cursor documentation for more information.

{
  "mcpServers": {
    "boundary": {
      "type": "streamable-http",
      "url": "http://localhost:8080",
      "headers": {
        "BOUNDARY_TOKEN": "<<BOUNDARY_TOKEN_HERE>>",
        "BOUNDARY_ADDR": "<<BOUNDARY_ADDR_HERE>>"
      }
    }
  }
}

Add the following configuration to your MCP client settings. Refer to the Claude Desktop documentation or the Amazon Q Developer documentation for the location of the settings file.

{
  "mcpServers": {
    "boundary": {
      "type": "streamable-http",
      "url": "http://localhost:8080",
      "headers": {
        "BOUNDARY_TOKEN": "<<BOUNDARY_TOKEN_HERE>>",
        "BOUNDARY_ADDR": "<<BOUNDARY_ADDR_HERE>>"
      }
    }
  }
}

Configure MCP clients for the Boundary MCP server

Requirements

Environment-based setup (binary only)

Client configuration

More information