> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getarbol.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect MCP through Composio

> Prerequisites and verification steps for publishing the Arbol MCP server as a Composio Custom MCP toolkit.

Composio connects to Arbol as a Custom MCP toolkit using dynamic-client-registration OAuth. Registration and synchronization are deployment operations owned by the standalone MCP repository.

## Prerequisites

Complete these before registering the toolkit:

1. Deploy `https://mcp.getarbol.com/mcp` and verify its health and MCP protocol behavior.
2. Publish MCP protected-resource metadata and Auth0 authorization-server metadata over HTTPS.
3. Enable dynamic client registration for approved third-party clients.
4. Enable on-behalf-of exchange from the MCP resource server to the Arbol API audience.
5. Confirm that the deployed API OpenAPI contract is the version used to generate MCP tools.

<Warning>
  Registering a toolkit before OAuth and the MCP endpoint are reachable creates an unusable integration. A successful toolkit upsert does not prove that authentication or tool execution works.
</Warning>

## Registration model

The toolkit uses Composio's `DCR_OAUTH` mode and the authorization server's discovery URL. The repository's registration script owns the exact API payload, toolkit slug, icon, and immutable application URL.

After one approved connected account exists, synchronize the toolkit so Composio reads the current MCP tool list. Re-run synchronization after a deployed OpenAPI change modifies generated tools.

## Verify the integration

<Steps>
  <Step title="Complete user authorization">
    Connect one test user in a non-production organization and confirm consent is granted to the intended MCP resource.
  </Step>

  <Step title="Inspect discovered tools">
    Compare Composio's tool inventory with the generated manifest from the same OpenAPI revision. Unexpected meta-tools or missing operations fail the rollout.
  </Step>

  <Step title="Run a read-only smoke test">
    Execute a bounded read such as listing agents and verify that results come from the test user's organization.
  </Step>

  <Step title="Test rejection paths">
    Verify expired tokens, missing API scopes, cross-organization identifiers, and revoked connections fail closed.
  </Step>
</Steps>

Do not publish mutation tools to production until read-only execution, delegated authority, audit correlation, and revocation have all passed.

For the current Custom MCP requirements, see [Composio's Custom MCP documentation](https://docs.composio.dev/docs/extending-sessions/custom-mcp).