Open WebUI

Open WebUI is a self-hosted chat interface that typically runs with Ollama as a local inference backend. This allows you to test AI Suite MCP completely without an external provider. You determine where Open WebUI and Ollama run, and accordingly, you must also ensure that Open WebUI can reach the TYPO3 host and recognizes its certificate.

The setup of the containers, the network, TLS, and any GPU acceleration are not part of this guide. The examples use the model qwen2.5:7b. The steps remain the same for any other model that can handle tool calls, such as llama3.1:8b or mistral-nemo. For pure smoke tests, qwen2.5:3b is also sufficient.

Requirements

enableMcp is enabled (see Configuration).
mcpAllowedRedirectUris and mcpAllowedOrigins can remain empty in development. In production, the callback URL or the origin of your Open WebUI installation should be entered there, so [openwebui-url] as the origin. The actual redirect URI your version sends is shown during the registration process in the log. Observed so far were [openwebui-url]/oauth/clients/ and [openwebui-url]/oauth/oidc/callback. Since the comparison is done via the prefix, the entry [openwebui-url]/oauth/ covers both cases.
mcpAllowedClientIds remains empty.
The backend group has enable_mcp_access and the required feature rights (see Permissions & Scopes).
In Ollama, there is a model that can handle tool calls, for example via ollama pull qwen2.5:7b.

When you first call [openwebui-url], you create an account. Depending on the configuration, the first user automatically becomes an administrator. This account is independent of the TYPO3 backend user. Then check under Settings → Connections that the connection to Ollama is established.

Set Up Tool Server

1. Create Connection. Open the Admin Panel via the avatar in the top right, switch to Settings → Tools on the left, and select Add Connection. Enter the following in the dialog:

Field	Value
Type	MCP Streamable HTTP
Name	for example `AI Suite MCP`
ID	`ai-suite-mcp`. The note `auto` in the field is just a placeholder; validation requires a real value.
URL	`[typo3-url]/aisuite-mcp`, without site prefix
Enabled	on
Authentication	OAuth 2.1

2. Register Client. Clicking on Register Client calls POST [typo3-url]/aisuite-mcp/oauth/register. The status display changes from Not registered to Registered. Then save.

3. Authenticate. Reopen the connection and click Authenticate. The authorization page opens at [typo3-url]/aisuite-mcp/oauth/authorize. After logging into TYPO3 and agreeing to the scopes, the token lands in Open WebUI, and the status changes to Connected.

4. Grant Access. By default, only the owner of the connection sees it in the tool selection. The Access button in the editing dialog allows you to share the connection with all users or with individual users and groups.

Increase Context Window

Ollama works with a context window of only 4096 tokens for most models. Just the tool definitions of the AI Suite MCP currently occupy around 10,000 tokens with 45 tools, plus system prompts and conversation history. Without adjustment, Ollama silently truncates the tool list. The model then never sees the tools and starts to fabricate, in the worst case, it explains MCP as "Microsoft Certified Professional" instead of sending a tool call.

A larger setting helps. Click on the model name in the chat header and select Edit Model, or alternatively Admin Panel → Settings → Models. There, under Advanced Parameters, set the Context Length (num_ctx) to 16384, higher if necessary. More context costs more VRAM. After saving, start a new conversation; existing chats retain the old value.

Enable Tools per Chat

MCP tool servers are not automatically active in every conversation. Start a new chat, select the model, click on the + symbol or the tool icon below the input field, and enable AI Suite MCP. Only then does Open WebUI send the tool definitions with the request to Ollama.

Troubleshooting

“Registration failed” when registering the client. The aiohttp library used by Open WebUI cannot verify the certificate of the TYPO3 host, which is typical for self-signed development certificates. In the Open WebUI environment, set AIOHTTP_CLIENT_SESSION_SSL=false and AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL=false.

Internal server error when authenticating, the log shows SSL: CERTIFICATE_VERIFY_FAILED. The httpx library ignores these environment variables and checks itself. The only solution is to make the root CA of the TYPO3 host known in the container, i.e., include it, merge it with the certifi bundle, and point SSL_CERT_FILE or REQUESTS_CA_BUNDLE to the merged file.

The model fabricates about MCP, although the tool server is connected. Ollama has truncated the prompt and lost the tool definitions. Increase the context window, see above.

The model claims it has no MCP access. The tool server is not enabled in the current chat.

For monitoring, the uvicorn log of Open WebUI is suitable for errors during registration and OAuth, as well as the Ollama log, which shows truncated prompts and the actual tool calls sent. Additionally, two operational notes. Model cache and Open WebUI database should be in persistent volumes, and WEBUI_SECRET_KEY must remain stable. If the key changes, all stored OAuth tokens become unusable because Open WebUI encrypts them with it. Other client-independent cases are collected under Connect Clients.