Prerequisites for the Nodinite MCP Endpoint
Prepare these items before you install Nodinite 7.4.0 or later, or update an older environment. The MCP Endpoint is consumed by AI clients, but it is hosted and operated as one of the Nodinite Core Services: when a prerequisite is missing, the installation can fail, or the endpoint stays unreachable even though the other Core Services are healthy.
Understanding What the Endpoint Depends On
port, identity, TLS, auth"] --> Package["fa:fa-file-zipper Generated package"] Package --> Site["fa:fa-plug MCP Endpoint
IIS web site"] Firewall["fa:fa-shield-halved Firewall
inbound port"] --> Site Cert["fa:fa-certificate TLS certificate"] --> Site Site --> Config["fa:fa-database Configuration Database"] Site -.->|"OAuth mode"| Entra["fab:fa-microsoft Microsoft Entra ID"]
Diagram: The Portal values become the generated package that creates the IIS web site; the firewall, certificate, Configuration Database access, and, for remote clients, Microsoft Entra ID must be in place for the endpoint to work.
Technical Checklist
| Verified | Topic |
|---|---|
| IIS and the required web server features are installed on the Core Services host | |
| A free TCP port for the MCP Server is entered in the Portal | |
| Firewall rules allow inbound traffic to that port from approved client networks | |
| A TLS certificate matches the FQDN that clients use | |
| The service identity is valid for your deployment policy | |
| For remote MCP clients: an MCP API app registration in Microsoft Entra ID, and OAuth mode in the Portal | |
| The service identity can reach the Configuration Database | |
| Updates from versions before 7.4.0 include the MCP Server port |
IIS and Server Requirements
The MCP Endpoint runs on the same host and runtime as the other IIS-hosted Core Services (.NET 10, ASP.NET Core Hosting Bundle). Use the same baseline:
The generated installation package creates the IIS web site, binding, and app pool; you don't create them by hand.
Port Planning Requirements
From 7.4.0, the MCP Endpoint needs its own port. Enter it for the MCP Server in the Portal under Servers → Core platform services, and check the result under Review and Download → Allocated ports.
New installations
Pick a free port that your network policy allows for inbound traffic, record it in your runbook, and enter it in the Portal before you download the package.
Updates from older versions
When an environment is older than 7.4.0, add the MCP Server port in the Portal in the same change as the Core Services update, so the update doesn't leave a partly deployed environment. See Update MCP Endpoint.
Service Identity
The MCP Endpoint runs under the identity set for the MCP Server in Servers → Core platform services. By default, all Core Services share one account; clear Same account for all Services to use a dedicated identity. Group Managed Service Accounts are supported; see gMSA accounts and Service Account Defaults.
Firewall and Access Planning
The MCP Server is the Core Service you are most likely to open to other networks: external MCP clients connect to it, often from developer machines. It reads the Configuration Database directly, validates OAuth tokens from Microsoft Entra ID, and is also called by the Web Client for the AI Assistant. The diagram shows each host, with the port on the arrow, drawn from the side that opens the connection.
Diagram: external MCP clients sign in with Microsoft Entra ID and call the MCP Server on its Portal port, directly or through a proxy; the Web Client calls it for the AI Assistant, and the MCP Server reads the Configuration Database.
Between the MCP clients and the MCP Server
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Inbound | External MCP clients (or the reverse proxy) | Core Services Server (MCP Server) | TCP (HTTPS) | MCP Server port | Streamable HTTP at /mcp |
Set in the Portal; open only from approved client networks, in the server firewall, any cloud NSG, and the client's egress path |
| Outbound | External MCP clients | Microsoft Entra ID (login.microsoftonline.com) |
TCP (HTTPS) | 443 | Sign in and get a bearer token | OAuth mode; see Register the MCP API in Microsoft Entra ID |
| Inbound | Core Services Server (Web Client) | Core Services Server (MCP Server) | TCP (HTTPS) | MCP Server port | MCP tools for the AI Assistant | Same server; no rule needed unless a host firewall restricts local traffic |
If a reverse proxy, web application firewall, or TLS offloading sits in front of the endpoint, check routing and certificates before go-live. MCP clients compare the advertised resource URL with the URL they connect to, so the scheme, host, and port must match exactly; see Choose One Canonical URL and External Access Requirements.
Between the MCP Server and SQL Server, Entra ID, and the domain controller
The SQL Server, MSDTC, and domain controller ports are shared by all Nodinite components; their full details live in SQL Server Firewall Configuration.
| Direction | Source | Destination | Protocol | Port(s) | Purpose | Notes |
|---|---|---|---|---|---|---|
| Outbound | Core Services Server (MCP Server) | SQL Server (Configuration Database) | TCP | 1433 | Read the Repository Model, views, and Articles; write Articles, Snippets, and Templates | Default instance port; named instances, UDP 1434, and MSDTC (TCP 135 + dynamic RPC range): Core Services to SQL Server |
| Outbound | Core Services Server (MCP Server) | Microsoft Entra ID (login.microsoftonline.com) |
TCP (HTTPS) | 443 | Read the OpenID configuration and token signing keys | OAuth mode only; through the proxy set in Step 3: Infrastructure if you use one |
| Outbound | Core Services Server (MCP Server) | Domain Controller | TCP/UDP | 53, 88, 389 | DNS, and Kerberos and LDAP for Windows Authentication and SQL Server sign-in | See Domain Controller ports |
What to get right
- No fixed default port: from 7.4.0 the MCP Server needs its own port in the Portal; the
44005in the AI examples is an example only. - Keep it stopped: if you select Keep the MCP Server stopped in the Portal, the site is deployed but doesn't listen; open the port when you start it.
- Versions: Nodinite versions before 7.4.0 have no MCP Server and no MCP port; add the port and its firewall rule in the same change as the update.
- DNS (53): the canonical host name must resolve from every client location, including through any proxy or CDN.
TLS and Authentication
- TLS: enter the TLS host name and certificate subject under Servers → Core host Configuration. Clients send Bearer tokens on every call, so use HTTPS; see How to perform hardening on your Nodinite installation.
- Remote MCP clients (Visual Studio Code, Claude Desktop, and similar) need OAuth mode. Choose OAuth 2.0 / OIDC under Auth → Auth mode, and enter the MCP Server Audiences and Web Client MCP Server Scope under Auth → MCP Server. Register the MCP API in Microsoft Entra ID as described in Register the MCP API in Microsoft Entra ID.
- Windows Authentication works only for same-domain callers that can use Negotiate; see Authentication Model.
Configuration Database Reachability
The MCP tools read the Repository Model, Monitor Views, Log Views, and Articles from the Configuration Database, and write Articles, Snippets, and Templates. The connection string is shared by all Core Services and is set in the Portal under Infrastructure → SQL Server connectivity. Check that the MCP Server identity has the same database access as the other Core Services.