Skip to main content
Composio connects to Arbol as a Custom MCP toolkit using dynamic-client-registration OAuth. Registration and synchronization are deployment operations owned by the standalone MCP repository.

​
Prerequisites

Complete these before registering the toolkit:
  1. Deploy https://mcp.getarbol.com/mcp and verify its health and MCP protocol behavior.
  2. Publish MCP protected-resource metadata and Auth0 authorization-server metadata over HTTPS.
  3. Enable dynamic client registration for approved third-party clients.
  4. Enable on-behalf-of exchange from the MCP resource server to the Arbol API audience.
  5. Confirm that the deployed API OpenAPI contract is the version used to generate MCP tools.
Registering a toolkit before OAuth and the MCP endpoint are reachable creates an unusable integration. A successful toolkit upsert does not prove that authentication or tool execution works.

​
Registration model

The toolkit uses Composio’s DCR_OAUTH mode and the authorization server’s discovery URL. The repository’s registration script owns the exact API payload, toolkit slug, icon, and immutable application URL. After one approved connected account exists, synchronize the toolkit so Composio reads the current MCP tool list. Re-run synchronization after a deployed OpenAPI change modifies generated tools.

​
Verify the integration

1

Complete user authorization

Connect one test user in a non-production organization and confirm consent is granted to the intended MCP resource.
2

Inspect discovered tools

Compare Composio’s tool inventory with the generated manifest from the same OpenAPI revision. Unexpected meta-tools or missing operations fail the rollout.
3

Run a read-only smoke test

Execute a bounded read such as listing agents and verify that results come from the test user’s organization.
4

Test rejection paths

Verify expired tokens, missing API scopes, cross-organization identifiers, and revoked connections fail closed.
Do not publish mutation tools to production until read-only execution, delegated authority, audit correlation, and revocation have all passed. For the current Custom MCP requirements, see Composio’s Custom MCP documentation.