Skip to main content

​
Prerequisites

  • AI assistant access is provisioned for your tenant.
  • Your user group holds at least one MCP permission — see Granting access. Without one the connection succeeds and offers nothing.
  • You know your Insight API address. It appears in the commands below as <api-fqdn>.

​
Command-line assistants

​
Claude Code

You are sent to your usual sign-in page. Once you have signed in, the assistant acts as you. The port is not arbitrary — see Why the port is fixed below.

​
Codex

Codex reads the callback port from its own configuration rather than from the command, so set it once in config.toml:
Then add the server and sign in:
Name the client explicitly. nobly-mcp is the client already registered for your organisation’s users, with the callback address above; without it Codex is left to negotiate a client of its own, which is not what your allowed addresses were set up for.
These options were checked against Codex CLI 0.152.0. Codex has renamed connection settings between releases, so if codex mcp add rejects an option, run codex mcp add --help and use the equivalent your version lists.

​
Hosted Claude connector

Claude on the web and Claude Desktop connect through Anthropic’s own callback addresses rather than a port on your machine. Those addresses are not allowed by default, so this does not work until someone adds them.
1

Add the connector callbacks

Someone holding Manage API clients opens Settings → Access → API clients and adds these two addresses to the MCP client:
2

Add the connector in Claude

Point it at https://<api-fqdn>/api/v3/mcp and sign in when prompted.
Leaving these off is a deliberate default: it means a tenant only reaches an outside service once someone has decided it should.

​
Connection details worth knowing

​
Why the port is fixed

The sign-in service matches the callback address exactly, and does not accept “any port” for local addresses. An assistant that picks a random port each run will fail to complete sign-in, so use the registered port 48123 for your organisation’s users.

​
Allowed addresses are per tenant

Which callback addresses are accepted is your tenant’s decision, managed in Settings → Access → API clients. Out of the box only the local addresses above are allowed. Anyone holding Manage API clients can add others — a fixed-port local tool, or the hosted connector addresses. Removing the local addresses stops command-line assistants from signing in. They are restored whenever the sign-in service is updated, so removing them is a temporary measure, not a lock-out.

​
Sessions are short, and refresh tokens rotate

Access tokens last five minutes, and refresh tokens rotate: using one issues a replacement and retires the one you used. A well-behaved client handles this without you noticing. A tool that caches a refresh token and keeps presenting the same one instead of the replacement will have its session ended, and you will be asked to sign in again.

​
Your token is your token

The credential an assistant holds is an ordinary Nobly Insight sign-in for your account. It is not restricted to assistant use, and it carries no protection against being reused elsewhere — so treat it exactly as you would your own password, and do not paste it into tools you would not sign into directly.

​
Troubleshooting

Introduction to Reporting

Understand reporting dashboards in Nobly Insight — how data sources, dashboards, and elements fit together for the people who build and view them.

Granting access

The permissions that decide which capabilities a user group’s assistants may use.

Single sign-on & federation

Sign in to Nobly Insight with your organisation’s own identity provider.