Ontology MCP

The Ontology MCP is a read-only Model Context Protocol (MCP) server for the Datastruct Ontology. Every request needs an OAuth 2.0 access token issued to one of the signed-in user’s personal OAuth credentials.

Server

The URL is also accepted with a trailing slash. Use the URL without a trailing slash in client configuration because it matches the token audience.

The server returns usage instructions when the client initializes. See Ontology MCP tools for the tool contract.

Credentials

Create a credential in Datastruct Console under My account → OAuth credentials → Connect an AI assistant. Open My account by selecting your name at the bottom of the sidebar. The OAuth credentials tab appears when the Ontology is available to your organization.

The default expiration is 30 days. A custom date can be up to one year away. A credential stops working at the end of its last day in your Console time zone.

Console lists supported clients with their callback URLs already registered. For any other MCP client, select Other and enter its redirect URL. The redirect URL must be an absolute https URL without a fragment or spaces. Plain http is rejected, including for localhost. The authorization request must use the same URL exactly.

The client secret is shown once, after the credential is created or its secret is rotated. Datastruct does not store it.

Connect an MCP client

Console shows these steps, tailored to the selected client, when you create a credential. Menu names vary by client.

1. In Console, open My account → OAuth credentials and select Connect an AI assistant.
2. Enter a name, select the client, and choose an expiration. For Other, enter the client’s redirect URL.
3. Select Create credential, then copy the client ID and client secret.
4. In your MCP client, add a custom connector or remote MCP server.
5. Enter the server URL, https://console.datastruct.co/ontology/mcp.
6. Choose OAuth authentication, then enter the client ID and client secret.
7. Connect. When the Datastruct page opens, sign in to Console if needed and select Authorize.

The client can then call the Ontology MCP tools. Selecting Cancel on the Datastruct page denies access.

Credential lifecycle

Only the credential owner can rotate its secret. The owner, and an organization admin who manages credentials, can revoke or delete it.

Authorization

The Ontology MCP uses the OAuth 2.0 authorization code grant with Proof Key for Code Exchange (PKCE).

During authorization, the user signs in to Datastruct Console and selects Authorize on the approval page. Only the credential’s owner can approve it, and only while the credential is unexpired and the Ontology is available to the owner’s organization. The authorization response includes the iss parameter.

Send the access token on every MCP request:

POST /ontology/mcp HTTP/1.1
Host: console.datastruct.co
Authorization: Bearer <access-token>
Content-Type: application/json
Accept: application/json, text/event-stream

Discovery

Clients discover the authorization server through OAuth 2.0 Protected Resource Metadata (RFC 9728).

GET /.well-known/oauth-protected-resource/ontology/mcp HTTP/1.1
Host: console.datastruct.co

GET /.well-known/oauth-protected-resource returns the same document.

Example response, with the issuer shown as a placeholder:

{
  "resource": "https://console.datastruct.co/ontology/mcp",
  "authorization_servers": ["<authorization-server-issuer>"],
  "scopes_supported": ["ontology:read"],
  "bearer_methods_supported": ["header"]
}

Read the issuer from this document instead of configuring it. Fetch the authorization server’s own metadata from the issuer for its authorization and token endpoints.

Token acceptance

The server accepts an access token only when all of these conditions hold:

• The token is current and was issued by the Datastruct authorization server.
• Its audience includes the server URL.
• It carries the ontology:read scope.
• It belongs to an active Console user.
• It was issued to one of that user’s own unexpired credentials.
• It was issued after the credential’s latest secret rotation.
• The Ontology is available to the user’s organization.

A token issued to another user’s credential is rejected, including a credential in the same organization.

Errors

HTTP errors return a JSON body with a detail message.

Every 401 and 403 insufficient_scope response includes a WWW-Authenticate header that names the metadata URL:

WWW-Authenticate: Bearer resource_metadata="https://console.datastruct.co/.well-known/oauth-protected-resource/ontology/mcp", error="invalid_token"

On invalid_token, obtain a new access token. If refresh fails, the credential may be expired, revoked, or rotated; check it in Console. Tool-level errors return a successful MCP response; see Ontology MCP tools.

Related explanation

• AI assistant access to the Ontology explains personal credentials, consent, and revocation.