MCP Server Integration

>What is the Sentinel EMS MCP Server?

>Preparing to Connect to the MCP Server

>Configuring Your MCP Client

>Verifying Your Connection and Running Your First Prompts

>Available Tools in the MCP Server

>Troubleshooting

New to Sentinel EMS?
See How to Use Sentinel EMS?

What is the Sentinel EMS MCP Server?

The Sentinel EMS Model Context Protocol (MCP) server, referred to as the MCP server hereafter, is a cloud-based bridge between your Sentinel EMS instance and compatible AI applications. The MCP server lets you work with Sentinel EMS using natural languages, so you can query and manage entitlement, customer, user, product, and partner data without writing custom API calls.

To use the MCP server, you must connect an MCP client to it. The MCP client is the component in your AI application that sends requests to the MCP server. The MCP server receives the requests, performs the requested operations in Sentinel EMS, and returns the results to the MCP client. The MCP client uses OAuth 2.0 to authenticate requests. When the MCP client has the required access, you can use natural language prompts to read, create, and update Sentinel EMS data.

The MCP server validates the OAuth 2.0 access token, applies the permissions associated with the MCP client, and restricts access to the Sentinel EMS instance associated with the MCP client.

You can use this guide to connect an MCP client to the MCP server, verify the connection, run prompts for read and write operations, and troubleshoot common issues.

How Does the MCP Server Work?

The Sentinel EMS MCP server enables compatible AI tools and agents to connect to and interact with your Sentinel EMS instance. The MCP client sends requests to the /mcp endpoint with an OAuth access token. The MCP server validates the access token, determines the associated Sentinel EMS instance and caller permissions, invokes the appropriate Sentinel EMS REST API operations, and returns the result to the MCP client.

With the Sentinel EMS MCP server, you can perform the following tasks:

>Search and retrieve entitlement, customer, and catalog data.

>Create and update entitlements, customers, and users, when the MCP client has the required access.

>Automate repetitive operations, such as checking entitlement status, looking up quantity of available licenses, or retrieving entitlements expiring within a given time period.

>Control access by configuring OAuth scopes and tool groups for the MCP client, such as read-only access for support tools and write access for fulfillment agents.

Supported MCP Clients

You can connect to the Sentinel EMS MCP server using the following MCP clients:

>Claude Code Command Line Interface (CLI)

>Gemini Command Line Interface (CLI)

>Custom MCP-capable agents, such as a Node.js application built with the MCP SDK

NOTE   Using Claude Code CLI as an MCP client requires a paid license.

Preparing to Connect to the MCP Server

Before configuring an MCP client to connect to the Sentinel EMS MCP server, perform the following preparation steps:

>Prerequisites

>Creating an OAuth Client

>Generating an Access Token

Prerequisites

Before you begin, complete the following prerequisites for connecting an MCP client to the Sentinel EMS MCP server:

>Install a code editor, such as Visual Studio Code or Notepad++.

>Install and set up a supported MCP client, such as Claude Code CLI.

>Get administrator access to the Sentinel EMS vendor portal for creating an OAuth client.

>Get your Sentinel EMS MCP endpoint, such as https://<SENTINEL_EMS_URL>/mcp. Contact Thales Customer Support for more information.

>Save the Token Endpoint for your Sentinel EMS instance.

>Ensure that you have a tool to generate an access token using OAuth client credentials, such as Postman, Windows PowerShell, or cURL.

Creating an OAuth Client

The Sentinel EMS MCP server uses OAuth 2.0 Client Credentials. This flow uses machine-to-machine authentication and does not require you to sign in. You must create a confidential OAuth client and use the client ID and client secret to obtain an access token for the MCP client. For more details, refer to OAuth Clients.

1.Log in to the Sentinel EMS vendor portal as an administrator.

2.Navigate to Identities & Access > OAuth Clients.

3.Click Add OAuth Client.

4.Configure the client using the following settings:

a.Client Type: Confidential

b.Grant Type: Client Credentials

c.Access Level: Administrator or Standard

NOTE   If you set the Access Level as Standard, you must set the Roles for the OAuth client.

5.Select Save to save the OAuth client.

6.On the OAuth Clients page, select the newly created client, and then click the Credentials tab.

7.Copy the generated Client ID and Client Secret and store the credentials securely.

TIP   Create a dedicated OAuth client for each user or team. Keep production credentials confidential, and exclude credentials from source control.

Generating an Access Token

You must generate an access token to authenticate yourself and connect your MCP client to the MCP server. Access tokens are valid for 55 minutes from the time of issue. The Client Credentials flow does not issue a refresh token. For long-running integrations, track token expiry locally and request a new access token before the current token expires. Use a 60-second buffer before expiry to avoid authentication failures during a request. For more details, refer to Creating Access Tokens.

Use the following steps to get an access token using Postman:

1.Open a new file in a code editor, such as Visual Studio Code or Notepad++.

2.Copy the following JSON and paste the JSON in the text editor window:

{
  "info": {
    "_postman_id": "7a1230f8-67e4-48a6-a25e-f54374ba999f",
    "name": "Client Credentials Token",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
    "_exporter_id": "30050041",
    "_collection_link": "https://go.postman.co/collection/30050041-7a1230f8-67e4-48a6-a25e-f54374ba999f?source=collection_link"
  },
  "item": [
    {
      "name": "token",
      "request": {
        "auth": {
          "type": "noauth"
        },
        "method": "POST",
        "header": [],
        "body": {
          "mode": "urlencoded",
          "urlencoded": [
            {
              "key": "grant_type",
              "value": "client_credentials",
              "type": "text"
            },
            {
              "key": "client_id",
              "value": "<client_id>",
              "type": "text"
            },
            {
              "key": "client_secret",
              "value": "<client_secret>",
              "type": "text"
            },
            {
              "key": "scope",
              "value": "openid",
              "type": "text"
            }
          ]
        },
        "url": {
          "raw": "https://<AUTH_URL>/realms/<realm>/protocol/openid-connect/token",
          "protocol": "https",
          "host": [
            "<AUTH_URL>"
          ],
          "path": [
            "realms",
            "<realm>",
            "protocol",
            "openid-connect",
            "token"
          ]
        },
        "description": "authentication"
      },
      "response": []
    }
  ]
}

3.Save the file as a JSON file and close the code editor.

4.Launch the Postman application, and import the JSON file into your workspace.

5.Open the token request and perform the following actions:

a.Set the Token Endpoint as the request URL.

b.Navigate to the Body tab and replace <client_id> with the Client ID and <client_secret> with the Client Secret generated for the OAuth client.

6.Select Send.

7.Copy the access_token value from the response.

Use the following steps to get an access token using Windows PowerShell:

1.Open a new file in a code editor, such as Visual Studio Code or Notepad++.

2.Copy the following code and paste the code in your text file:

$body = @{
    grant_type    = "client_credentials"
    client_id     = "xx-xx-xx-xx"
    client_secret = "xx-xx-xx-xx"
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri "your_token_endpoint" `
    -ContentType "application/x-www-form-urlencoded" `
    -Body $body


$token = $response.access_token

# Print token on console
Write-Host "`nAccess Token:`n"
Write-Host $token

# Copy token to clipboard
$token | Set-Clipboard

Write-Host "`nToken copied to clipboard."

3.Update the following values in the script:

a.client_id: Enter the Client ID of your OAuth client.

b.client_secret: Enter the Client Secret of your OAuth client.

c.Uri: Enter the Token Endpoint for your Sentinel EMS instance.

4.Save the file with the PowerShell (.ps1) extension.

5.Navigate to the folder where you saved the file.

6.Right-click anywhere in the folder and select Open in Terminal to launch Windows PowerShell.

7.Run the script using the following command:

.\[your_text_file_name].ps1

The script prints the access token to the terminal and copies the token to your clipboard.

Use the following steps to get an access token using cURL:

1.Open Windows PowerShell or Command Prompt.

2.Enter the following command: 

curl.exe -X POST "TOKEN_ENDPOINT" -d "grant_type=client_credentials" -d "client_id=CLIENT_ID" -d "client_secret=CLIENT_SECRET"

3.Update the following values in the command:

a.TOKEN_ENDPOINT: Enter the Token Endpoint for your Sentinel EMS instance.

b.CLIENT_ID: Enter the Client ID of your OAuth client.

c.CLIENT_SECRET: Enter the Client Secret of your OAuth client.

4.Press the Enter key.

You will receive a response that contains the access token. Copy this access token for configuring your MCP client.

Configuring Your MCP Client

Configure your MCP client for connecting to to the Sentinel EMS MCP server. Follow the steps for your MCP client:

>Claude Code Command Line Interface (CLI)

>Gemini Command Line Interface (CLI)

>Other MCP Clients

>Multiple Environments

Claude Code Command Line Interface (CLI)

Use the following steps to connect Claude Code CLI to the Sentinel EMS MCP server:

1.Navigate to C:\Users\[your_username].

2.Open the .claude.json file in a code editor, such as Visual Studio Code or Notepad++.

3.Add the mcpServers block in the outermost braces:

"mcpServers": {
    "EMS-MCP":{
      "type": "http",
      "url":"https://EMS_URL/mcp",
      "headers":{
         "Authorization":"Bearer YOUR_ACCESS_TOKEN"
         }	
     }
}

4.Update the following details in the code:

a.EMS_URL: Enter the URL of your Sentinel EMS instance.

b.YOUR_ACCESS_TOKEN: Enter the access token that you obtained from Postman, Windows PowerShell, or cURL.

5.Verify the JSON syntax:

•Keep exactly one space between Bearer and the token.

•Keep the leading dot in .claude.json.

6.Save the file and close the code editor window.

7.Navigate to C:\Users\[your_username]\.claude.

8.Open settings.json in your code editor.

9.Add the following block in the outermost braces:

"enabledMcpjsonServers": [
    "EMS-MCP":
]

10.Save the file and close the code editor window.

Gemini Command Line Interface (CLI)

Use the following steps to connect Gemini CLI to the Sentinel EMS MCP server:

1.Navigate to the .gemini folder, located under C:\Users\[your_username].

2.Open the settings.json file in a code editor.

3.Add the mcpServers block in the outermost braces:

"mcpServers": {
    "EMS-MCP":{
      "type": "http",
      "url":"https://EMS_URL/mcp",
      "headers":{
         "Authorization":"Bearer YOUR_ACCESS_TOKEN"
         }	
     }
}

4.Update the following details in the code:

a.EMS_URL: Enter the URL of your Sentinel EMS instance.

b.YOUR_ACCESS_TOKEN: Enter the access token that you obtained from Postman, Windows PowerShell, or cURL.

5.Verify the JSON syntax and keep exactly one space between Bearer and the token.

6.Save the file and close the code editor window.

Other MCP Clients

For other MCP-capable clients, connect over HTTP and send the token with every request using the following values:

>Endpoint: https://EMS_URL/mcp

>Authorization header: Bearer YOUR_ACCESS_TOKEN

>Content type: application/json

Because the endpoint is stateless, your client must include the token with each request. For long-running integrations, you must refresh the token before the 55-minute expiry.

Multiple Environments

To connect to multiple Sentinel EMS environments, such as stage and production environments, register each environment as a separate MCP server with a distinct name and a token from that environment.

"mcpServers": {
    "EMS-MCP-stage":{
      "type": "http",
      "url":"https://STAGE_EMS_URL/mcp",
      "headers":{
         "Authorization":"Bearer STAGE_ACCESS_TOKEN"
         }	
     },
    "EMS-MCP-prod":{
      "type": "http",
      "url":"https://PROD_EMS_URL/mcp",
      "headers":{
         "Authorization":"Bearer PROD_ACCESS_TOKEN"
         }	
     }
}

For Claude Code, add both server names to the enabledMcpjsonServers block in the settings.json file, located at C:\Users\[your_username]\.claude. Use distinct names such as EMS-MCP-stage and EMS-MCP-prod to reduce the risk of changing the wrong environment.

Verifying Your Connection and Running Your First Prompts

Follow these steps to ensure that you're connected to the Sentinel EMS MCP server:

1.Run the following read-only prompt and verify that you receive an output:

Without creating or changing anything, tell me: how many customers and entitlements are created in Sentinel EMS in last 5 days?

2.If you configured the MCP server using a Command-Line Interface (CLI):

c.Run the mcp command to see the connected MCP servers and browse available tools.

d.Run the mcp list command to see the list of configured MCP servers and their status.

3.Press the Esc key twice to return to the chat.

TIP   You can inspect the raw tool list with MCP Inspector by running this command:

           npx @modelcontextprotocol/inspector

Now, you're ready to run your first prompts as explained below:

1.Start with read-only prompts that preserve data without modification. For example:

a.Discover enabled products: Show me all enabled products in Sentinel EMS with their name and version.

b.Search for a customer: Search for customer Example Corp in Sentinel EMS and tell me their account status.

c.Find recent entitlements: Show me entitlements created in the last 7 days. Include customer name, product, and state, and give the response in a table.

2.After these prompts work, you can move to create and update operations if your OAuth client has write access.

Available Tools in the MCP Server

When you connect to the Sentinel EMS MCP server using the /mcp endpoint, the MCP server exposes 25 default tools. You can access 64 additional tools by specifying the toolgroups parameter.

Following are the 25 default tools loaded at the bare /mcp endpoint:

>searchProducts

>searchLicenseModels

>getMarketGroup

>searchProductBundles

>getlicensemodel

>searchCustomerExternalAdmins

>searchActivations

>getFeature

>searchPartners

>getEntitlement

>searchCustomers

>searchNamespaces

>getUser

>searchUsers

>getNamespace

>getProductKey

>getProductBundle

>getEnforcement

>searchEntitlements

>searchFeatures

>searchMarketGroups

>getCustomer

>getProduct

>getActivatees

>getActivation

Adding Tool Groups

A tool group is a bundle of tools exposed by the MCP server. The following tool groups are available:

>Entitlement

>Activation

>Customer

>Partner

>Catalog

>Enforcement

>Configuration

>Transaction

Follow these steps to add one or more tool groups and access a maximum of 64 additional tools available in the Sentinel EMS MCP server:

1.Open the JSON file for your MCP client in an code editor. For example:

•Claude: C:/Users/[your_username]/.claude.json

•Gemini: C:/Users/[your_username]/.gemini/settings.json

2.In the mcpServers block, update the url to: https://EMS_URL/mcp?toolgroups=[tool_group_name].

3.Replace EMS_URL with the value from your environment.

4.Replace [tool_group_name] with the name of the tool group that you want to access. To add multiple tool groups, specify the tool groups as a comma-separated list. For example:

https://<EMS_URL>/mcp?toolgroups=Entitlement,Activation,Customer

5.Save the JSON file.

6.Launch your MCP client and connect to the MCP server. You can now use all the tools included in the added tool group.

Troubleshooting

The following table lists the common connection and tool issues: 

Issue Summary Cause What to Check?
Authentication required or 401 error The token is missing, malformed, or expired.

Open the JSON file for your MCP client, and confirm that the "Authorization" header is present. If the header is present, decode your access token at jwt.io and check the expiry details of the access token. If the access token is older than 55 minutes, generate a new access token and connect your MCP client again.
Configuration not found The host or endpoint does not match a configured Sentinel EMS instance. Verify that the URL host is correct for your Sentinel EMS instance. Confirm the endpoint with Thales Customer Support.
No tools or fewer tools than expected The toolgroups value filters the available tools.

Open the JSON file for your MCP client and review the toolgroups value in the URL. Remove the ?toolgroups=[tool_group_name] part from your URL to load the default tools.

Transaction tools are missing The Transaction tool group is off by default. The Transaction tool group is disabled for security reasons. Contact Thales Customer Support to enable the Transaction tool group for your Sentinel EMS instance.
Server shows as disconnected under /mcp The MCP client is not working, or the JSON for your MCP client is invalid. Open the JSON file for your MCP client and check the syntax, including commas, quotation marks, and the leading dot in the file name. Relaunch your MCP client and try connecting to the MCP server again.
Intermittent errors, such as timeouts or token-service and errors A transient or infrastructure issue.

Retry the request. If the issue persists, contact Thales Customer Support and share the following details:

>Name and version of your AI application

>Date and time of failure

>Exact prompt details

>Tool name

>Error details or the complete response from your AP application
High latency, over one second Sentinel EMS REST API or network can affect response time. Contact Thales Customer Support.