Open WebUI

Open WebUI is a self-hosted chat interface that typically runs with Ollama as a local inference backend. This allows you to test AI Suite MCP completely without an external provider. You determine where Open WebUI and Ollama run, and accordingly, you must also ensure that Open WebUI can reach the TYPO3 host and recognizes its certificate.

The setup of the containers, the network, TLS, and any GPU acceleration are not part of this guide. The examples use the model qwen2.5:7b. The steps remain the same for any other model that can handle tool calls, such as llama3.1:8b or mistral-nemo. For pure smoke tests, qwen2.5:3b is also sufficient.

Requirements

enableMcp is enabled (see Configuration).
Open WebUI version 0.6.31 or newer, where MCP via Streamable HTTP is built in (see Open WebUI's guide to MCP). Only an admin can create tool servers.
mcpAllowedRedirectUris and mcpAllowedOrigins can stay empty in development. In production, mcpAllowedRedirectUris takes the prefix [openwebui-url]/oauth/clients/, under which Open WebUI forms the callback address [openwebui-url]/oauth/clients/[connection-id]/callback for each connection, and mcpAllowedOrigins takes the origin [openwebui-url]. Set WEBUI_URL in Open WebUI to the public address of the installation, otherwise the callback address is built with a wrong host. [openwebui-url]/oauth/oidc/callback belongs to the SSO sign-in to Open WebUI itself and is not meant here.
mcpAllowedClientIds stays empty.
The backend group has enable_mcp_access and the required feature permissions (see Permissions & Scopes).
Ollama has a model that supports tool calls, for example via ollama pull qwen2.5:7b.

When you call [openwebui-url] for the first time, you create an account. Depending on the configuration, the first user automatically becomes administrator. This account is independent of the TYPO3 backend user. Then check in the admin settings of Open WebUI that the connection to Ollama is established.

Set up the tool server

1. Create the connection. As an admin, create an external tool server of type MCP Streamable HTTP in the integration settings. Where the settings are located and which fields the dialog shows is described in Open WebUI's guide to MCP. For TYPO3, these values matter:

Field	Value
Name	AI Suite MCP (this is how the server later appears in the tool selection)
Type	MCP Streamable HTTP
URL	`[typo3-url]/aisuite-mcp`, without a site prefix
Authentication	OAuth 2.1
Connection ID	`ai-suite-mcp`. Open WebUI builds the callback address from it, so do not change the ID after registering.

2. Register the client. When registering, Open WebUI calls POST [typo3-url]/aisuite-mcp/oauth/register. Save the connection afterwards so that the OAuth details are kept.

3. Authenticate. Start the OAuth sign-in on the saved connection. The authorization page opens at [typo3-url]/aisuite-mcp/oauth/authorize. After the TYPO3 sign-in and consent to the scopes, the token is handed to Open WebUI.

4. Share access. By default, only the owner of the connection sees it in the tool selection. Via the connection's access control, it can be shared with all users or with individual users and groups.

Increase the context window

The tool definitions of AI Suite MCP alone take up around 10,000 tokens with currently 46 tools, plus the system prompt and the conversation history. If the context window is too small, Ollama silently cuts off the tool list. The model then never sees the tools and starts to make things up, in the worst case it explains MCP as “Microsoft Certified Professional” instead of sending a tool call.

Ollama chooses the context window depending on the graphics memory, often too small for the tool definitions. Increase it (num_ctx in the model or OLLAMA_CONTEXT_LENGTH), see Ollama's guide to context length. More context costs more graphics memory. Start a new conversation after the change, existing chats keep the old value.

Enable tools per chat

MCP tool servers are not automatically active in every conversation, and tool servers with OAuth cannot be set as default tools of a model. Start a new chat, select the model and switch on AI Suite MCP in the tool selection below the input field. Only then does Open WebUI send the tool definitions with the request to Ollama.

Troubleshooting

“Registration failed” when registering the client. The aiohttp library used by Open WebUI cannot verify the certificate of the TYPO3 host, typically with self-signed development certificates. Set AIOHTTP_CLIENT_SESSION_SSL=false and AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL=false in the Open WebUI environment.

Internal server error when authenticating, the log shows SSL: CERTIFICATE_VERIFY_FAILED. The httpx library ignores these environment variables and verifies on its own. The only remedy here is to make the root CA of the TYPO3 host known in the container, i.e. mount it, merge it with the certifi bundle and point SSL_CERT_FILE or REQUESTS_CA_BUNDLE to the merged file.

The model makes things up about MCP although the tool server is connected. Ollama has cut off the prompt and lost the tool definitions in the process. Increase the context window, see above.

The model claims it has no MCP access. The tool server is not switched on in the current chat.

To follow along, use the uvicorn log of Open WebUI for errors during registration and OAuth, and the Ollama log, which shows truncated prompts and the tool calls actually sent. Two notes on operation: the model cache and the Open WebUI database belong in persistent volumes, and WEBUI_SECRET_KEY must stay stable. If the key changes, all stored OAuth tokens become unusable, because Open WebUI encrypts them with it. Further client-independent cases are collected under Connecting Clients.