Halo MCP | Access Halo Through Your AI Tools | Halo

Model Context Protocol (MCP) connects an AI application to Halo. This guide calls that application the AI app. Each person uses their own Halo account.

Halo hosts the MCP server. You do not need to install a server. The connection has two read-only tools: search_halo and get_halo_details. These tools cannot send messages, publish requests, or change Halo records.

Technical terms

• Remote MCP: MCP access to a server outside the AI app.

• Transport: the method that carries messages between the AI app and server. Streamable HTTP is an MCP transport. SSE means Server-Sent Events.

• OAuth: a protocol for authorization. Authorization gives permission for access. Authentication checks identity.

• Token: a value that represents authorization. An access token permits access. A refresh token supports access-token renewal. A bearer token permits access for its holder.

• Metadata: information that describes connection settings. Discovery lets an AI app read these settings automatically.

• Issuer: the authorization server that issues tokens.

• Scope: a named category of access that an AI app requests.

• Dynamic client registration (DCR): automatic registration of an AI app with an authorization server.

• Client ID: an identifier for an AI app registration. Client secret: a secret for that registration.

• Public client: an AI app that cannot keep a client secret confidential. A confidential client can keep that secret confidential.

• PKCE: Proof Key for Code Exchange, an OAuth security mechanism. S256 identifies its SHA-256 method.

• Redirect URI: the exact callback URL where the browser returns after authorization. URI means Uniform Resource Identifier.

• Header: information that accompanies a request.

• Halo skill: instructions that help the assistant recognize when and how to use Halo.

• Server-to-server connection: communication between servers, separate from browser access.

How do I configure team-wide access to the MCP?

Preamble: Prepare access to the AI app

• If you do not have a centrally managed AI app, select one with these capabilities:

  • Remote MCP.

  • Streamable HTTP.

  • Browser-based OAuth authorization.

  • Publication of a connection to people across your workspace.

• Examples include Copilot, Claude Cowork, and Glean. Check that your AI app's plan and administrator settings support centralized setup with separate authentication for each person.

• Get IT approval for the AI app, its AI provider, and its storage of tokens, prompts, and results.

Prepare Halo MCP access

• Ask your Halo account contact to check MCP access for your company.

• Select a person for the test with a verified Halo sponsor account in that company.

• Check that this person can authenticate at Halo.

Each person must connect with their own Halo account. Do not share accounts or tokens. Single sign-on (SSO) lets a person use one identity to access multiple services. If your company uses SSO, check the existing Halo login process with your Halo contact. This guide does not cover SSO setup.

⭐ Add the connection

1. Open the AI app's MCP or connector settings.

2. Add a remote MCP server with the name Halo.

3. Enter this server URL: https://www.halo.science/mcp.

4. If the AI app asks for a transport, select Streamable HTTP.

5. Select OAuth authorization with separate authentication through each person's own account.

   1. If the AI app supports and permits automatic discovery, it will read Halo's connection metadata automatically. If discovery is unavailable or IT policy blocks discovery, use the Manual Settings below. Check the AI app's registration requirements in this case.

6. Publish or enable the connection for the approved pilot people or groups through the AI app's access settings.

   1. Before you expand access, check that these people can find Halo in the intended chat or agent interface.

7. Where supported, add the Halo skill through the AI app's approved mechanism for skills or instructions.

   1. Get the Halo skill from your account contact. Make the skill available to the same audience. The skill helps the assistant recognize when and how to use Halo. It does not replace the connection or each person's authorization.

Centralized setup makes the connection available. It does not authenticate people with Halo or grant them a Halo account. The steps below apply across supported AI apps. They do not prescribe menus for specific AI apps.

⚠ Manual Settings (if needed)

Use automatic MCP discovery where your AI app supports it and IT policy permits it. If your AI app requires explicit settings, use the values below. These public connection endpoints appear in Halo's discovery metadata. They are not credentials.

Never include these credentials in shared setup documents:

• Passwords.

• Client secrets.

• Access tokens or refresh tokens.

Discovery metadata

• Protected resource metadata:

  • https://www.halo.science/.well-known/oauth-protected-resource

• Authorization server metadata:

  • https://pleasing-phantom-76.authkit.app/.well-known/oauth-authorization-server

The issuer advertises dynamic client registration and support for client-ID metadata documents. Check whether your AI app uses either automatically. If it asks for a client ID or secret you do not have, stop. Ask Halo to coordinate registration with the AI app administrator.

Copilot: discovery, Dynamic, and Manual OAuth

Copilot products and connector forms differ. Check the exact product and fields with the AI app administrator.

• Dynamic discovery: Where supported and permitted, let the AI app discover Halo's protected-resource metadata. Then let it discover the AuthKit authorization-server metadata.

• Dynamic: Explicit authorization and token URLs do not necessarily disable dynamic client registration. Use the AuthKit URLs above. If the form has a registration URL field, use the DCR URL above. Otherwise, check how the AI app gets the registration endpoint. Do not assume that the authorization and token URLs are sufficient.

• Manual: Use a client ID issued for this connector's registration with its exact redirect URI. Where required, use a client secret issued for that registration. Before you select Manual, ask your Halo contact and AI app administrator to check support for manual registration. This check must cover your specific Copilot product and connector.

Keep the hosts separate. https://www.halo.science/mcp is the MCP resource. OAuth authorization, token exchange, and registration use the advertised AuthKit endpoints. Do not derive https://www.halo.science/register from the MCP server URL. It is not Halo's MCP registration endpoint for AI apps.

An IT policy that disables discovery does not necessarily prohibit DCR. Check both policies separately.

People: authenticate at the time of use

1. Find the Halo connection in your AI app.

2. Select the Halo connection.

3. At the connection or authorization prompt, authenticate directly with Halo in the browser through your own account.

4. Complete the authorization steps.

5. Return to the AI app.

Each person's authorization is separate.

Test the connection

Use the test person's account to check that Halo is discoverable after IT publishes the connection.

Complete the authentication steps above before this test.

1. Ask the AI app: “Use Halo to find biodegradable packaging solutions.”

   1. Check that the AI app calls search_halo.

2. If a result is available, ask: “Show me more details on the first Halo result.”

   1. Check that the AI app calls get_halo_details.

3. Open a returned Halo link.

Resolve connection problems

Frequently Asked Questions (FAQs)

Is OAuth the same as our corporate SSO?

No. OAuth authorizes the AI app to call Halo as a particular person. Corporate SSO is a way that person authenticates with Halo. Configuration of one does not automatically configure the other. Check the company's existing Halo login separately. Check any SSO requirements separately.

Will Halo appear in ordinary search, or will chat use Halo automatically?

That depends on the AI app. An MCP connection lets the assistant call Halo. The connection alone does not index Halo's data into the AI app's ordinary search results. Check the actual access point with IT.

1. First test an explicit “Use Halo…” prompt.

2. Then test a natural request for external R&D partners without naming Halo.

3. If only the explicit prompt works, review tool enablement, agent instructions, and the Halo skill with IT.

The connection may work correctly even though automatic tool selection needs adjustment.

Is the Halo skill required to connect?

The skill supplies instructions that help the assistant recognize when and how to use Halo. It does not replace the MCP connection, each person's authorization, or access controls. Where supported, install it through the AI app's approved mechanism for skills or instructions.

What data and actions are available?

Halo searches the catalog that its MCP exposes. This catalog contains solutions, innovators, and organizations, including eligible solutions from previous AI scouting. The connection does not give unrestricted access to all Halo data. It is not a connector for private proposals and account activity. A search does not trigger fresh web scouting on demand.

The assistant can help draft text. These read-only tools cannot publish a PulseCheck, send a message to someone, or save a solution. These actions occur in the Halo web application.

Can we limit access to one team? What happens when someone leaves?

IT can publish the connection only to the approved pilot audience where the AI app supports that control. Each person still needs eligible Halo access. If SSO restricts Halo access, check the configured identity-provider groups and enforcement with Halo. A hidden connector does not itself revoke a person's Halo access.

When a person leaves, include both the AI app's connection and Halo account/SSO access in the access-removal process.

Where do prompts and results go?

The AI app sends Halo the arguments for each tool call, such as a search query or a result identifier. The AI app receives Halo results. A tool argument is an input value for a tool call.

The MCP connection does not require the AI app to send your full chat history. However, tool arguments may include information from your conversation. Do not include confidential information in test queries.

Review your AI app's policies with your IT team. Include policies for storage and use of prompts, tokens, and returned results.

Do we need firewall changes, or is a browser login enough?

Both browser authentication and the AI app's server-to-server connection must work.

IT should check access to:

• The Halo endpoint.

• The discovered authorization server.

• The AI app's callback flow.

A successful browser login does not prove that the hosted AI app can reach Halo.

What if the AI app has a connection but the test fails?

• Halo is missing for the person: Check the correct workspace, pilot audience, and published tool/agent. An administrator's own successful connection is not a test for another person.

• OAuth reports an invalid client or redirect URI: Record the error. Record the configured redirect URI without query parameters. Ask Halo and IT to check registration.

• Login succeeds but the return to the AI app fails: Check the browser session/account and callback policy. Then restart authorization from the AI app.

• The assistant answers without a Halo tool call: Explicitly select the enabled Halo tool/agent. Ask “Use Halo…”. Check tool activity in the chat UI.