Connect Gemini

Get the connection URL first

Open Settings → MCP in the helpdesk and copy the connection URL. It is that deployment's own address, and a deployment with MCP switched off shows no URL because there is nothing to connect to. Every <MCP-HOST-PLACEHOLDER> below is that value.

The steps have been written from Google's current documentation and from this server's transport and authentication configuration, both of which are readable in source. They have not been proved by driving a Gemini account against a public deployment of this product.

What you are connecting to


URL	`https://<MCP-HOST-PLACEHOLDER>/mcp`
Transport	Streamable HTTP
Credential	An OAuth 2.0 bearer token, in the `Authorization` header
Registration	Dynamic Client Registration, so there is nothing to pre-register

Source: services/runtime/src/runtime/mcp/asgi.py and services/runtime/src/runtime/mcp/verifier.py, which explains why this server binds a token by audience and scope rather than by a pre-registered client id — an MCP client that self-registers never has one.

The Gemini web app

Go to gemini.google.com and open Settings & help → Connected apps.
Add a custom app and paste the connection URL.
Sign in with your helpdesk account. Because this server supports Dynamic Client Registration, the Advanced features credential fields stay empty.

Custom connected apps there are part of Gemini Spark, which at the time of writing needs a personal Google Account, an eligible plan, an account holder aged 18 or over in the US, and Keep Activity switched on. If any of that does not hold, use the CLI below instead — it has no such restriction.

The Gemini CLI

gemini mcp add --transport http auralis-helpdesk https://<MCP-HOST-PLACEHOLDER>/mcp

Or write it into settings.json yourself. Naming the scope explicitly is worth doing: the CLI can discover it from the endpoint, and stating it removes the case where discovery does not and every call is then refused for a reason that reads like a server fault.

{
  "mcpServers": {
    "auralis-helpdesk": {
      "httpUrl": "https://<MCP-HOST-PLACEHOLDER>/mcp",
      "oauth": { "enabled": true, "scopes": ["mcp:access"] }
    }
  }
}

The scope above is this deployment's KEYCLOAK_MCP_REQUIRED_SCOPE. It is published in scopes_supported on the discovery document and shown beside the connection URL in Settings → MCP; if your deployment sets a different value, use that one.

Confirm with a tool call

Ask Gemini to list your open tickets. That drives list_tickets, which needs only the viewer role and no arguments at all.

If you belong to more than one workspace, the first call is refused and asks you to name one. Ask again naming the workspace, which the client passes as workspace_id.

If a step fails

The failures are the same ones every client hits, and they look different from each other. Troubleshooting lists them with what to do about each.

What you are connecting to

The Gemini web app

The Gemini CLI

Confirm with a tool call

If a step fails

On this page