Connect AI Clients to Virtual Appliance and AppDynamics MCP Servers

Connect the supported Claude and Codex clients to the Virtual Appliance and AppDynamics MCP servers.

Select the supported client setup that you wish to connect with your Virtual Appliance.

Select a Client Setup

Client Connection method Local bridge
Claude Desktop Local mcp-remote configuration Required for static Bearer headers
Claude Code Direct Streamable HTTP configuration in .mcp.json Not required
Codex CLI, IDE extension, or desktop host Direct Streamable HTTP configuration through codex mcp or config.toml Not required

Supported MCP Server Actions on Virtual Appliance

The Virtual Appliance MCP server is bundled with the tools that can perform the following actions on Virtual Appliance:
  • Identify cluster nodes, namespaces, pods, services, and deployments.
  • Perform pod operations.
  • Detect problematic pods and monitor events.
  • Monitor node and namespace resources.
  • List certificates, check their validity, and apply Ingress certificates.
  • Check the health of application services.
  • Configure the hybrid mode.

For more information, see Available MCP Server Tools.

Connection workflow

  1. Prepare to connect to the MCP servers.
  2. Verify the MCP endpoints.
  3. Connect Claude Desktop to the MCP servers, connect Claude Code to the MCP servers, or connect Codex to the MCP servers.
  4. Use the MCP tools and follow the security guidance for MCP connections.
  5. Use Troubleshoot MCP connections and the MCP connection quick reference when needed.

Prepare to connect to the MCP servers

Confirm network and software requirements, and obtain separate credentials for Virtual Appliance MCP and AppDynamics MCP.

  • Virtual Appliance MCP and AppDynamics MCP are deployed and running on the appliance.
  • Your computer can resolve and reach VA-DNS-NAME on HTTPS port 443.
  • You have the CA certificate for the Virtual Appliance ingress certificate if your operating system does not already trust the certificate.
  • For Claude Desktop, install Node.js 18 or higher for mcp-remote.
  • For Codex, install the Codex CLI or IDE extension and log in according to your organization's standard setup.
Virtual Appliance MCP and AppDynamics MCP use different authentication models. Keep their credentials separate.
  1. On a Virtual Appliance node, run the following command as an authorized administrator:
    CODE 
    appdcli access-key mcp
    The command displays the current Virtual Appliance MCP token and asks whether to rotate it.
  2. Answer no unless you intend to invalidate every client configuration that uses the current Virtual Appliance MCP token.
  3. Obtain an AppDynamics Bearer token for your user from your AppDynamics administrator or the approved token workflow for your environment.
    AppDynamics MCP forwards this token to AppDynamics, so the tools operate with that user's permissions.
You have a Virtual Appliance MCP token and an AppDynamics Bearer token for the corresponding servers.
Warning: Do not reuse the Virtual Appliance token for AppDynamics MCP. A Virtual Appliance token authorizes Virtual Appliance MCP access. An AppDynamics user token authorizes AppDynamics MCP access and determines AppDynamics role-based access control.

Verify the MCP endpoints

Verify DNS, routing, ingress, and TLS before configuring a Claude or Codex client.

Your computer can resolve and reach the Virtual Appliance DNS name. Health checks do not require an Authorization header.
Use the health URLs only for connectivity checks.
  1. If a publicly trusted or operating-system-trusted certificate protects the endpoints, run these commands:
    CODE 
    curl --fail --show-error https://<VA-DNS-NAME>/va-mcp/health
curl --fail --show-error https://<VA-DNS-NAME>/appdynamics-mcp/health
  2. If an organization or private CA protects the endpoints, specify the CA certificate:
    CODE 
    curl --fail --show-error --cacert /absolute/path/va-ca.pem \
  https://<VA-DNS-NAME>/va-mcp/health

curl --fail --show-error --cacert /absolute/path/va-ca.pem \
  https://<VA-DNS-NAME>/appdynamics-mcp/health
Both requests return HTTP 200. The response bodies can differ because the two MCP implementations expose separate health handlers.

Connect Claude Desktop to the MCP servers

Use mcp-remote as a local STDIO-to-HTTP bridge for the Virtual Appliance-hosted MCP endpoints.

The bridge runs locally and connects to the Virtual Appliance over your computer's network path. It is required because these endpoints use fixed Bearer headers.
  1. Locate the Claude Desktop configuration file.
    • On macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
    • On Windows: %APPDATA%\Claude\claude_desktop_config.json
  2. Add both MCP server definitions. Replace the DNS name, token placeholders, and CA path.
    JSON 
    {
  "mcpServers": {
    "va-mcp": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://<VA-DNS-NAME>/va-mcp",
        "--transport", "http-only", "--header", "Authorization:${VA_AUTH_HEADER}"],
      "env": {
        "VA_AUTH_HEADER": "Bearer <VA-MCP-token>",
        "NODE_EXTRA_CA_CERTS": "/absolute/path/va-ca.pem"
      }
    },
    "appdynamics-mcp": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://<VA-DNS-NAME>/appdynamics-mcp",
        "--transport", "http-only", "--header", "Authorization:${APPD_AUTH_HEADER}"],
      "env": {
        "APPD_AUTH_HEADER": "Bearer <AppDynamics-token>",
        "NODE_EXTRA_CA_CERTS": "/absolute/path/va-ca.pem"
      }
    }
  }
}
    If the operating system already trusts the Virtual Appliance certificate, remove both NODE_EXTRA_CA_CERTS entries. The no-space form Authorization:${VA_AUTH_HEADER} avoids an argument-escaping issue on Windows.
  3. Save valid JSON and completely quit Claude Desktop.
  4. Restart Claude Desktop.
  5. Open a new conversation and inspect the tools or connector menu.
  6. Confirm that va-mcp and appdynamics-mcp are connected.
Claude Desktop can use tools from both Virtual Appliance hosted MCP servers.
Warning: npx can download or run the mcp-remote package. In managed environments, use an organization-approved pinned version or internally distributed bridge.

Connect Claude Code to the MCP servers

Configure direct Streamable HTTP connections to Virtual Appliance MCP and AppDynamics MCP in a project.

Claude Code supports Streamable HTTP MCP servers and custom Authorization headers directly. Environment-variable expansion keeps tokens out of the shared project file.
  1. Create or update .mcp.json in the project root:
    JSON 
    {
  "mcpServers": {
    "va-mcp": {
      "type": "http",
      "url": "https://<VA-DNS-NAME>/va-mcp",
      "headers": {"Authorization": "Bearer ${VA_MCP_BEARER_TOKEN}"}
    },
    "appdynamics-mcp": {
      "type": "http",
      "url": "https://<VA-DNS-NAME>/appdynamics-mcp",
      "headers": {"Authorization": "Bearer ${APPD_MCP_BEARER_TOKEN}"}
    }
  }
}
  2. Export the secrets before starting Claude Code:
    CODE 
    export VA_MCP_BEARER_TOKEN='<VA-MCP-token>'
export APPD_MCP_BEARER_TOKEN='<AppDynamics-token>'

# Required only when the operating system does not trust the VA ingress CA:
export NODE_EXTRA_CA_CERTS='/absolute/path/va-ca.pem'

claude
  3. Review the URLs and approve both project-scoped MCP servers when Claude Code prompts you.
  4. Verify the server configuration:
    CODE 
    claude mcp list
claude mcp get va-mcp
claude mcp get appdynamics-mcp
  5. Run /mcp in an interactive Claude Code session to inspect the connection state.
Claude Code connects directly to both Streamable HTTP endpoints. An OAuth browser login is not expected.
Important: A one-user configuration can use claude mcp add --transport http, but a token on the command line can be exposed in shell history. Prefer environment expansion for long-lived configurations.

Connect Codex to the MCP servers

Configure Codex to connect directly to Virtual Appliance MCP and AppDynamics MCP with environment-backed Bearer tokens.

The Codex CLI, IDE extension, and desktop host share MCP configuration for the same Codex host.
  1. Export both Bearer tokens in the environment that starts Codex:
    CODE 
    export VA_MCP_BEARER_TOKEN='<VA-MCP-token>'
export APPD_MCP_BEARER_TOKEN='<AppDynamics-token>'
  2. For the Virtual Appliance packaged Codex workflow, set the private CA certificate if the operating system does not already trust the VA ingress certificate:
    CODE 
    export CODEX_CA_CERTIFICATE='/absolute/path/va-ca.pem'
  3. Add both Streamable HTTP servers:
    CODE 
    codex mcp add va \
  --url https://<VA-DNS-NAME>/va-mcp \
  --bearer-token-env-var VA_MCP_BEARER_TOKEN

codex mcp add appdynamics \
  --url https://<VA-DNS-NAME>/appdynamics-mcp \
  --bearer-token-env-var APPD_MCP_BEARER_TOKEN
    If a server name already exists, inspect it with codex mcp get va or codex mcp get appdynamics before replacing it.
  4. Verify both server configurations:
    CODE 
    codex mcp list
codex mcp get va --json
codex mcp get appdynamics --json
  5. Restart the Codex IDE extension or desktop host.
  6. Run /mcp in an interactive Codex session to inspect active servers.
Codex connects directly to both Streamable HTTP endpoints and reads each Bearer token from its configured environment variable.

You can define the same configuration in ~/.codex/config.toml or, for a trusted repository, .codex/config.toml:

CODE 
[mcp_servers.va]
url = "https://<VA-DNS-NAME>/va-mcp"
bearer_token_env_var = "VA_MCP_BEARER_TOKEN"

[mcp_servers.appdynamics]
url = "https://<VA-DNS-NAME>/appdynamics-mcp"
bearer_token_env_var = "APPD_MCP_BEARER_TOKEN"

Use the MCP tools

Start with read-only discovery and identify the intended MCP server when a request applies to either data source.

Virtual Appliance MCP examples

  • Using Virtual Appliance MCP, show the health of the Virtual Appliance cluster.
  • Using Virtual Appliance MCP, list recent warning events for the Controller namespace.
  • Using Virtual Appliance MCP, inspect the logs for this failing pod.

For more guided prompt examples, see Example Virtual Appliance Prompts.

AppDynamics MCP examples

  • Using AppDynamics MCP, list the applications I can access.
  • Show the highest-impact business transaction errors in the last hour.
  • Investigate the latency increase and summarize likely causes.

Review tool requests

Review every tool request before approval. Pay particular attention to tools that change configuration, restart workloads, rotate credentials, or otherwise modify the environment.

Troubleshoot MCP connections

Use the symptoms, likely causes, and resolutions to diagnose Virtual Appliance MCP and AppDynamics MCP connection failures.

Connection problems

Symptom Likely cause Resolution
Health URL returns 404 The deployment uses the wrong external path or an older ingress configuration. Use /va-mcp/health or /appdynamics-mcp/health. Confirm deployment of the matching health ingress.
MCP URL returns 404 The configuration includes an extra internal suffix. Use /va-mcp or /appdynamics-mcp. Do not append /mcp.
401 Unauthorized from Virtual Appliance MCP Missing, incorrect, or rotated Virtual Appliance token Run appdcli access-key mcp on the Virtual Appliance and update only the VA MCP token.
401 or 403 from AppDynamics MCP Expired or invalid AppDynamics token, or insufficient role-based access control Obtain a current user token and confirm that the user can access the requested AppDynamics data.
Certificate verification fails The client does not trust the private CA. For Claude, set NODE_EXTRA_CA_CERTS. For the Virtual Appliance packaged Codex workflow, set CODEX_CA_CERTIFICATE. Alternatively, install the CA through the approved operating-system trust-store process.
Claude Desktop shows disconnected Invalid JSON, unavailable Node.js, or a bridge startup failure Validate the JSON, run node --version and npx --version, and then completely restart Claude Desktop.
Claude Desktop works on macOS but not Windows The header parser changes spaces in the argument. Use Authorization:${AUTH_HEADER} with AUTH_HEADER set to Bearer token.
Codex reports a missing Bearer-token variable. The environment that starts the Codex client does not contain the variable. Export VA_MCP_BEARER_TOKEN and APPD_MCP_BEARER_TOKEN, and then restart the Codex client.
Codex cannot validate the Virtual Appliance certificate. The Codex client cannot access the private ingress CA. Set CODEX_CA_CERTIFICATE to the readable PEM CA bundle, or install the CA through the approved trust-store process.
Codex server configuration exists but tools remain unavailable. The user did not restart the client, or the server failed initialization. Run codex mcp get name --json, restart the IDE extension or desktop host, and inspect /mcp.
Claude web connector cannot reach the Virtual Appliance. A private Virtual Appliance or static non-OAuth header blocks the web connector. Use the Claude Desktop local bridge or Claude Code from a computer with Virtual Appliance network access.
One server works and the other fails. The configuration swaps tokens or URLs. Check each configuration entry independently against the endpoint table in Connect AI Clients to Virtual Appliance and AppDynamics MCP Servers.

Claude Desktop logs

On macOS, inspect recent local MCP logs with this command:

CODE 
tail -n 50 -F ~/Library/Logs/Claude/mcp*.log

Bridge diagnostic mode

Temporarily add "--debug" to the args array after "http-only". Remove the option after troubleshooting because verbose logs can contain sensitive operational details.

Security guidance for MCP connections

Protect endpoint connections, credentials, client configuration, and tool approvals when using Virtual Appliance MCP and AppDynamics MCP.

  • Connect only to the Virtual Appliance DNS name supplied by your organization.
  • Use HTTPS and validate the certificate chain. Do not use NODE_TLS_REJECT_UNAUTHORIZED=0 in production.
  • Keep the Virtual Appliance MCP token and AppDynamics token separate. Never commit either token to source control.
  • Restrict permissions on client configuration files that contain secrets. Prefer environment-variable references where supported.
  • Use an individual AppDynamics token so AppDynamics role-based access control and auditing reflect the actual user.
  • Rotate credentials according to organizational policy. Coordinate Virtual Appliance token rotation because it affects every configured Virtual Appliance MCP client.
  • Enable only the tools needed for the task and review tool calls before allowing actions.

You can use the security features to safeguard data, connection, and interactions with AI clients. See Security Features of the MCP Server.

MCP connection quick reference

Look up the endpoint URLs, transport, authentication format, and common Codex commands for Virtual Appliance MCP and AppDynamics MCP.

Connection values

Item Value
Virtual Appliance MCP client URL https://VA-DNS-NAME/va-mcp
Virtual Appliance MCP health URL https://VA-DNS-NAME/va-mcp/health
Virtual Appliance token command appdcli access-key mcp
AppDynamics MCP client URL https://VA-DNS-NAME/appdynamics-mcp
AppDynamics MCP health URL https://VA-DNS-NAME/appdynamics-mcp/health
Transport Streamable HTTP
Authentication header Authorization: Bearer server-specific-token
Codex add command codex mcp add name --url url --bearer-token-env-var environment-variable
Codex verification codex mcp list, codex mcp get name --json, or /mcp

External references