Build with AI Front Door Integrate. Extend. Deploy.

AI Front Door exposes its tools, MCP servers, and knowledge resources as a platform that any developer can integrate into their own agents, services, and workflows. This page covers everything you need to get started — from registering your application and obtaining an OAuth 2.0 access token, through to running your first agent using the Exco Partners MCP server.

All API access is authenticated using OAuth 2.0. Register your application to receive a client_id and client_secret, then exchange these credentials for a short-lived access token using the Client Credentials grant. Include the access token in the Authorization header of every API request.

Before you can call any AI Front Door API you must register an application. Registration gives you a client_id and client_secret that you use to obtain OAuth 2.0 access tokens. Tokens are scoped to an application registration and carry the permissions needed to call specific tools and knowledge endpoints.

How to register

1. Sign in to the AI Front Door portal.
2. Navigate to Apps → Register New App.
3. Give your app a name, select the tools and knowledge resources it needs access to, and save.

You can use an AI Front Door MCP server to get access to registered tools and knowledge resources for any MCP-compatible agent runtime. The server URL and transport details are shown on your app registration page for each tool.

MCP server details

For an MCP integration, the following details are required:

• Transport: HTTP (Streamable HTTP transport)

• Server URL: e.g. https://ai.excopartners.com/api/ai/tools/mcp/methods-mcp

• Authentication: Follow the instuctions for the specific authentication methods of the MCP.

Add an MCP to a Microsoft Copilot Agent

You can easily add an MCP from this site to your custom Copilot Agents.

1. Open Copilot Studio and edit your agent.
2. In the tools section, choose Add Tool.
3. Click the Custom tab and select the Custom MCP option.
4. Add the MCP details from the AI Front Door config page, including the MCP Server URL.
5. Choose the authentication method as registered in your app.
6. Your agent will now have access to the MCP tools.

Add an MCP to Claude

Claude reaches an AI Front Door MCP server in two places: the Claude apps (claude.ai on the web, Claude Desktop and mobile) as a custom connector, and Claude Code as a remote HTTP server. Both rely on the discovery pair this server already publishes. An unauthenticated request returns 401 with a WWW-Authenticate challenge pointing at /.well-known/oauth-protected-resource, which leads the client on to /.well-known/oauth-authorization-server and the token endpoint. Because that metadata advertises a registration_endpoint and supports authorization_code, refresh_token and PKCE S256, Claude can either register a client dynamically or use the client_id and client_secret from your registered app on the My Apps page. The scope is tools:invoke.

Claude apps: web, Desktop and mobile

On the Free, Pro and Max plans you add the connector yourself.

1. Open Customize → Connectors.
2. Choose Add custom connector.
3. Enter the MCP server URL, for example https://ai.excopartners.com/api/ai/tools/mcp/methods-mcp.
4. Open Advanced settings if you want to supply the OAuth Client ID and Client Secret from your registered app. Leave it closed and Claude registers a client dynamically instead.
5. Choose Add.

On Team and Enterprise plans an Owner installs it for the organisation first, under Organization settings → Connectors → Add → Custom, selecting Web if asked for a connector type. Members then open Customize → Connectors, find the connector labelled Custom, and click Connect to authenticate as themselves.

A newer two-step dialog is rolling out, so you may see a different form. It asks for a Name and the MCP server URL, then an Authentication choice (Sign in now, Sign in when needed, or No sign-in) and an OAuth client choice: use Claude's published identity, register automatically via Dynamic Client Registration, or use your own OAuth client. For the last of those, enter your client ID and leave the secret blank unless the authorisation server requires one.

Authentication settings, meaning OAuth credentials and request headers, cannot be changed after a connector has been added. To change them you remove the connector and add it again, and members have to reconnect.

The connection to the MCP server originates from Anthropic's servers, not from the user's machine, so the AI Front Door MCP endpoint has to be reachable over public HTTPS.

Connectors are enabled per conversation. Open the + button in the chat composer and turn the connector on under Connectors.

Claude Code

Claude Code adds the same server from the command line.

claude mcp add --transport http ai-front-door https://ai.excopartners.com/api/ai/tools/mcp/methods-mcp

The default scope is local: the server is written to ~/.claude.json and is available only to you, in the current project. Use --scope project to write a .mcp.json in the project root that can be committed and shared through version control, or --scope user to make the server available across all of your projects.

Authenticate with the /mcp slash command inside Claude Code and follow the browser OAuth flow, or from the command line with claude mcp login ai-front-door (Claude Code v2.1.186 and later). Add --no-browser where the environment has no local browser, such as a remote shell. Claude Code stores the token and refreshes it for you.

Check the result with claude mcp list. Every configured server reports one of three states:

✔ Connected
! Needs authentication
✘ Failed to connect

To use the OAuth credentials from a registered app on the My Apps page rather than dynamic registration, pass them when you add the server:

claude mcp add --transport http \
  --client-id your-client-id \
  --client-secret \
  --callback-port 8080 \
  ai-front-door https://ai.excopartners.com/api/ai/tools/mcp/methods-mcp

The --client-secret flag takes no value on the command line. Claude Code prompts for masked input and stores the secret securely rather than writing it into the configuration file.

The project-scoped equivalent, committed as .mcp.json in the project root, is:

{
	"mcpServers": {
		"ai-front-door": {
			"type": "http",
			"url": "https://ai.excopartners.com/api/ai/tools/mcp/methods-mcp",
			"oauth": {
				"clientId": "your-client-id",
				"callbackPort": 8080
			}
		}
	}
}

The client secret never appears in this file. Add an oauth.scopes string, space separated, to restrict what Claude Code asks for, for example "tools:invoke".

The following example shows how to build a minimal agent using the Anthropic Claude SDK that connects to the Exco Partners MCP server via AI Front Door. The example includes OAuth 2.0 token acquisition as the first step.

Install dependencies

npm install @anthropic-ai/sdk dotenv
npm install --save-dev tsx typescript

TypeScript agent with OAuth 2.0 and MCP

The Claude MCP connector is a beta feature of the Messages API, so the request carries the mcp-client-2025-11-20 beta flag. Claude opens the MCP connection itself, which is why the server has to be reachable over public HTTPS and why the AI Front Door access token is passed as authorization_token.

import Anthropic from "@anthropic-ai/sdk";
import "dotenv/config";

const baseUrl = process.env.AIFD_BASE_URL ?? "https://ai.excopartners.com";
const mcpToolSlug = process.env.AIFD_MCP_TOOL_SLUG ?? "methods-mcp";

interface TokenResponse {
	access_token: string;
	token_type: string;
	expires_in: number;
	scope?: string;
}

/** Exchanges the registered app's client credentials for a short-lived Bearer token. */
async function getAccessToken(): Promise<string> {
	const response = await fetch(`${baseUrl}/api/oauth/token`, {
		method: "POST",
		headers: { "Content-Type": "application/x-www-form-urlencoded" },
		body: new URLSearchParams({
			grant_type: "client_credentials",
			client_id: process.env.AIFD_CLIENT_ID ?? "",
			client_secret: process.env.AIFD_CLIENT_SECRET ?? "",
			scope: "tools:invoke",
		}),
	});

	if (!response.ok) {
		const failure = await response.json() as { error: string; error_description?: string };
		throw new Error(`Token request failed: ${failure.error} (${failure.error_description ?? "no description"})`);
	}

	const token = await response.json() as TokenResponse;
	return token.access_token;
}

async function main(): Promise<void> {
	const accessToken = await getAccessToken();
	const anthropic = new Anthropic();

	const response = await anthropic.beta.messages.create({
		model: "claude-opus-5",
		max_tokens: 2048,
		messages: [
			{
				role: "user",
				content: "Which delivery method suits a discovery engagement, and what artefacts does it produce?",
			},
		],
		mcp_servers: [
			{
				type: "url",
				url: `${baseUrl}/api/ai/tools/mcp/${mcpToolSlug}`,
				name: "ai-front-door",
				authorization_token: accessToken,
			},
		],
		tools: [
			{
				type: "mcp_toolset",
				mcp_server_name: "ai-front-door",
			},
		],
		betas: ["mcp-client-2025-11-20"],
	});

	for (const block of response.content) {
		if (block.type === "text") {
			console.log(block.text);
		}
	}
}

main().catch((error: unknown) => {
	console.error(error);
	process.exit(1);
});

Save the file as agent.ts and run it with npx tsx agent.ts.

Environment variables

# .env

# Anthropic API key used by the Claude SDK
ANTHROPIC_API_KEY=your-anthropic-api-key

# Credentials from your AI Front Door app registration
AIFD_BASE_URL=https://ai.excopartners.com
AIFD_CLIENT_ID=your-client-id
AIFD_CLIENT_SECRET=your-client-secret
AIFD_MCP_TOOL_SLUG=methods-mcp

Knowledge resources are available over a plain REST API. This is useful when you want to retrieve guidance, policy documents, or reference data outside of an agent context — for example, to pre-populate RAG pipelines or build search interfaces.

First obtain an OAuth 2.0 access token using the client_credentials grant (see Getting Started above), then include it as a Bearer token in every request.

List knowledge resources

Get a specific knowledge item by slug

TypeScript helper with token acquisition

If you have a general-purpose agent that needs domain expertise it does not have, you can delegate to the AI Front Door domain agent using the A2A protocol. Your agent POSTs a task to the A2A endpoint and receives a structured result.

Authenticate with OAuth 2.0 before calling the A2A endpoint, as with all other AI Front Door APIs.

POST a task to the domain agent

The endpoint speaks JSON-RPC 2.0. Send message/send with a single user message; a GET to the same URL returns the agent card, and tasks/get, tasks/cancel and agent/getAuthenticatedExtendedCard are also available.

curl -X POST https://ai.excopartners.com/api/ai/tools/a2a/methods-a2a \
  -H "Authorization: Bearer your-access-token" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "message/send",
    "params": {
      "message": {
        "kind": "message",
        "messageId": "6f1b2a34-9c5e-4f87-a0d2-3b7c1e5d8a90",
        "role": "user",
        "parts": [
          {
            "kind": "text",
            "text": "Review this delivery plan and tell me which CoreMethods artefacts are missing."
          }
        ]
      },
      "configuration": {
        "acceptedOutputModes": ["text/plain"],
        "blocking": true
      }
    }
  }'

A2A task result

The domain agent answers synchronously, so the result is an A2A message rather than a long-running task. Keep the returned contextId and send it on your next message to continue the same conversation.

{
	"jsonrpc": "2.0",
	"id": 1,
	"result": {
		"kind": "message",
		"messageId": "b8d4c7e2-1f60-4a93-8c5b-2e9d0a4f6371",
		"role": "agent",
		"contextId": "3a5e9c81-7b24-4d06-9f18-5c2a7e0b4d93",
		"taskId": "e07c4b19-2d58-4af3-b6c1-9d83f5e2a7c0",
		"parts": [
			{
				"kind": "text",
				"text": "The plan covers discovery and design, but it has no test strategy and no benefits realisation plan."
			}
		]
	}
}