ITS Core documentation — MCP server

Search and read the ITS Core documentation from your coding agent.

Serving docs 7.2.739889003 · 3,495 pages, 4,487 chunks, 18,386 symbols · semantic + keyword · browse the docs site

Endpoint

MCP URL

https://docs-mcp.dev.its-core.net/mcp

Transport

Streamable HTTP, stateless

Authentication

OAuth 2.1, authorization code + PKCE — discovered, nothing to configure

Authorization server

This server, forwarding to https://login.dev.its-core.net

Scope

its-core-docs:read

Tools

• search_its_core_docs — hybrid search across the whole corpus
• get_doc_page — read a whole page once search has found it
• lookup_dotnet_api — resolve a .NET type or member
• get_component_changelog — a component's release history
• list_components — what is documented at all

Set up a client

One command, no client id, no callback port. This server answers discovery itself and forwards the sign-in to https://login.dev.its-core.net, so a client learns everything it needs from the URL alone.

Claude Code

claude mcp add --transport http its-core-docs https://docs-mcp.dev.its-core.net/mcp

Then run /mcp inside a session and pick Authenticate. A browser opens, you sign in once, and the token is stored and refreshed for you. Add --scope user to the command to make the server available in every project rather than only the current one.

GitHub Copilot (VS Code)

Put this in .vscode/mcp.json to share it with the repository, or run MCP: Open User Configuration from the Command Palette to have it in every workspace:

{
  "servers": {
    "its-core-docs": {
      "type": "http",
      "url": "https://docs-mcp.dev.its-core.net/mcp"
    }
  }
}

VS Code opens a browser for the sign-in the first time the server is started.

CI and scripts

Non-interactive callers go straight to the IdP with the separate client_credentials client its-core-docs-mcp-ci — no browser, no redirect, nothing this server is involved in. Its secret lives in the Docs AI Azure DevOps variable group; it is never printed here and does not belong in a repository.

TOKEN=$(curl -s https://login.dev.its-core.net/connect/token \
  -d grant_type=client_credentials \
  -d client_id=its-core-docs-mcp-ci \
  -d client_secret="$DOCS_MCP_CI_SECRET" \
  -d scope=its-core-docs:read | jq -r .access_token)

curl -s https://docs-mcp.dev.its-core.net/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json, text/event-stream" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_components","arguments":{}}}'

When it does not work

• 401 with a valid token. The audience has to be exactly https://docs-mcp.dev.its-core.net. A token issued for another API will authenticate and then be refused here.
• invalid_request: The redirect_uri is not registered. This one comes from this server, not from the IdP. Loopback callbacks are accepted on any port and any path; anything else has to be listed in the chart. Report the exact redirect URI your client used.
• The sign-in reaches the IdP and fails there. Then it is not the client's configuration: this server sends the IdP an ordinary https callback on its own host. Look for the bridge's warnings in the pod log, and for OidcClientRegistrar, which registers its-core-docs:read at startup.

Health

https://docs-mcp.dev.its-core.net/_monitoring/health reports readiness and the docs version it is serving. /_monitoring/health/all additionally calls the AI Hub and takes upwards of 40 seconds, so ask it from a dashboard, never from a probe.