Connect an MCP client
Understand the authenticated MCP endpoint, role limits and the difference between managed-account and Cloudflare Access client authentication.
Check the authentication mode
Sparta exposes /mcp on the workspace hostname. Every tool uses existing API validation, permissions, audit logging and resource checks.
Managed-account installations authenticate same-origin browser requests with their Sparta session. An arbitrary bearer token or Cloudflare assertion does not substitute for a native session.
External OAuth clients use the retained Access-mode integration. On an Access-mode installation, an operator enables Cloudflare Managed OAuth on the existing Access application and verifies a real client sign-in. Do not assume that procedure works for a managed-account installation.
Use the endpoint
Configure the workspace's HTTPS /mcp URL in a compatible Streamable HTTP client. The endpoint accepts authenticated POST requests; GET and DELETE return 405.
Use the client's tool discovery for current schemas. Visible tools remain role-filtered and resource-scoped. A tool call does not elevate an auditor or control owner.
Files and mutations
MCP uploads and embedded downloads are capped at 512 KiB. Use the web application for larger files.
Approval, sign-off, sharing, publication and erasure tools perform real actions. Review arguments and current versions before calling them. Stored provider credentials are not returned.
See account security.