MCP Server CD5 Iteration 5 (Continuous Delivery) – Release Notes

In this document:

Upgrade Notes

OAuth Delegation for MCP Client Authorization

The Pricefx MCP Server now uses OAuth delegation to handle user tokens. The MCP Server acts as the OAuth intermediary between the AI client and your Pricefx partition. The AI client registers with the MCP Server through dynamic client registration and receives a token issued by the MCP Server. The MCP Server obtains and stores the Pricefx user token on the client's behalf, so the Pricefx token is never passed to the AI client.

What Changes

• Client registration – AI clients register with the MCP Server automatically. You no longer need to register each AI client in the oauthConfiguration Advanced Configuration Option. You just need to register the MCP Server.

  JSON

  {
    "knownClients": {
      "pricefx-mcp-server": {
        "redirect_uri": "https://mcp.pricefx.com/<instance>/<partition>/auth/callback"
      }
    }
  }
  

  Example: https://mcp.pricefx.com/mint-stable.pricefx.com/copilot-discretefx/auth/callback

• Connector Setup – When you create the connector in your AI client, select dynamic client registration as the registration method instead of user defined OAuth Client (CIMD or DCR). You no longer need to copy the Callback URL or enter an OAuth Client Id.

• Sign-in flow – During sign-in, users go through additional confirmation pages before the connection is established.

Mitigation Steps

1. Remove the existing Pricefx connector in your AI client and create it again using the updated setup.

2. Sign in again and confirm access on each authorization page.

3. If your partition contains knownClients entries in the oauthConfiguration Advanced Configuration Option that were added only for MCP connections, review whether you still need them.

Tool Access Control for Private Connections

The Pricefx MCP Server can now limit which tools each user can use on a private connection. Every user is an operator by default and can use only the tools on the fixed Operator Allowlist. Users listed in the mcp_configurator_user_login_names Advanced Configuration Option are configurators and can use every tool on the partition. Configurators must also have at least the View Audits and Users (USERAUDIT) role. The MCP Server needs this role to check whether a user is on the configurator list. Users without it are treated as operators, even if their login name is on the list.

Regression Risk

When tool access control is turned on, users who are not listed as configurators lose access to every tool that is not on the Operator Allowlist. This includes most Groovy tools defined in your partition configuration. Those tools disappear from the user's tool list and can no longer be called. Agents, prompts, or MCP roles that depend on them stop working for those users.

Configurators without the View Audits and Users (USERAUDIT) role are also affected. Even if their login name is in mcp_configurator_user_login_names, they are treated as operators and can use only the allowlisted tools.

Mitigation Steps

1. Add the login names of users who need access to all tools to the mcp_configurator_user_login_names Advanced Configuration Option.

2. Assign each of these users at least the View Audits and Users (USERAUDIT) role. For more information see User Roles.

3. Ask the users to reconnect and check that the Groovy tools appear in their tool list.

Improvements