Claude.ai

Claude.ai runs in Anthropic's infrastructure. There is no local client that you install, and therefore no computer from which the connection is established. Anthropic calls your MCP endpoint directly. The server must therefore be publicly reachable via HTTPS, with a certificate from a generally trusted CA. Internal DNS names, localhost, *.ddev.site and self-signed certificates do not work here. A firewall or IP allowlist must allow Anthropic's outbound range (see Anthropic's IP addresses).

AI Suite MCP authenticates Claude.ai via OAuth 2.1 with Dynamic Client Registration. Claude offers custom request headers, which could be used to send a static token as with Claude Desktop, only to a limited extent. This guide therefore uses OAuth. Custom connectors are available in all Claude plans, with different limits (see Anthropic's help on custom connectors).

• enableMcp is enabled (see Configuration).
• mcpAllowedRedirectUris contains claude.ai/api/mcp/auth_callback.
• mcpAllowedOrigins contains claude.ai.
• mcpAllowedClientIds stays empty. Otherwise, the client ID generated via Dynamic Client Registration has to be added by hand afterwards.
• The backend group has enable_mcp_access and the required feature permissions (see Permissions & Scopes).

Check the public reachability from a computer outside your network. Both calls must return 200:

curl -sS [typo3-url]/aisuite-mcp/health
curl -sS [typo3-url]/.well-known/oauth-authorization-server

If either of them fails because of an IP allowlist, HTTP Basic Auth or a self-signed certificate, Claude.ai aborts the connection without a meaningful message. If the installation is behind Basic Auth, the MCP paths must be exempted, see Production Operation. Also check that the Authorization header reaches PHP. On Apache with mod_php or FCGI, it is often discarded, which leads to endless 401 responses after a successful OAuth flow. You can find the necessary rewrite rule (Apache) or the fastcgi_param (Nginx) under Production Operation.

1. Create the connector. Create a custom connector in Claude and enter [typo3-url]/aisuite-mcp as the URL. Where to find this in your plan and which fields the dialog shows is described in Anthropic's guide to custom connectors. Only use the root URL without a site prefix, a URL like [typo3-url]/[site]/aisuite-mcp ends in a 404.

2. Set sign-in. Under Authentication, choose “Sign in now” and under OAuth client “Register automatically”. The preselected option “Use Claude's published identity” requires Client ID Metadata Documents, which AI Suite MCP does not offer.

3. Connect and consent. When connecting, Claude.ai registers itself at [typo3-url]/aisuite-mcp/oauth/register and then opens a window with the authorization page. There, you sign in with your TYPO3 backend credentials, even if you are already signed in to the backend, followed by the consent page with the requested scopes. After confirmation, the token is handed to Claude.ai and the connector counts as connected.

4. Enable the connector per conversation. Custom connectors are not automatically active in every chat. Switch the connector on in the conversation as described in Anthropic's guide linked above. Only then does the model get to see the tool definitions.

You can end the access from both sides. In Claude.ai, you remove the connector, in the TYPO3 backend you revoke the token in the MCP dashboard of the backend module “AI Suite” with “Revoke”.

Claude reports that the MCP server is unreachable, and there is nothing in the TYPO3 log. The server cannot be reached from Anthropic's network, responds too slowly, or the certificate is not trusted (self-signed, expired, wrong host name). Check the two curl calls from an external computer and whether a firewall blocks Anthropic's IP range (see Anthropic's IP addresses).

The model claims it has no MCP access although the connector is connected. The connector is not switched on in the current chat, see step 4.

Individual tools are missing (generating, translating, images, audits). The backend user lacks the matching AI Suite feature permissions. Add them and re-authenticate in the connector.

For debugging, the web server's access log is the best source, because there are no viewable logs on the Claude.ai side. A 404 on /aisuite-mcp indicates a site prefix in the URL, repeated 401 responses indicate the missing Authorization header. A 200 on /aisuite-mcp/oauth/token should be followed immediately by a 200 on POST /aisuite-mcp. Further client-independent cases are collected under Connecting Clients.