Note: OAuth authentication is only supported for Commvault environments running SP42 CU 27 and above. OAuth must be properly configured in the CommServe before using this option.

When using OAuth authentication, you'll need:

• Discovery Endpoint URL: The OAuth discovery/metadata endpoint
• Client ID: Your OAuth application's client identifier
• Client Secret: Your OAuth application's client secret
• Required Scopes: Required OAuth scopes
• Base URL: Base URL of the MCP Server

Important: The redirect URI must be set to OAUTH_BASE_URL/auth/callback in your OAuth provider's app/client configuration.

The following values will be collected during the setup process:

• Commvault Access Credentials: You need a valid access_token and refresh_token to authenticate with the Commvault API. Learn how to generate these tokens here: Creating an Access Token – Commvault Docs

• Secret Key: This secret must be included by the MCP Client in the Authorization header of all tool requests. It acts as a security layer for tool access in remote server. You can set your own.

Important: When using traditional token-based authentication, the setup script requires a secure, OS-native keyring backend to store sensitive credentials securely. Only secure backends are allowed for security reasons.

Supported Secure Backends by Platform

When prompted "Is this a Metallic setup?", select yes. The setup script will automatically configure:

• Gateway URL: https://api.metallic.io

No additional configuration is needed for the server URL; all other setup steps (transport mode, authentication, etc.) proceed as normal.

For production deployments, it is recommended to use a reverse proxy with TLS/HTTPS and security headers. The MCP server should bind to 127.0.0.1 (localhost only) to prevent direct public access.

Quick Setup

1. Configure MCP Server for localhost: Set MCP_HOST=127.0.0.1 in your .env file
2. Install reverse proxy: Choose nginx or Caddy
3. Configure TLS: Use Let's Encrypt for automatic certificate management
4. Add security headers: Configure OWASP-recommended headers (HSTS, X-Frame-Options, CSP, etc.)
5. Update client config: Use https://your-domain.com/mcp instead of http://HOST:PORT/mcp

Refer to your AI client’s documentation for integration steps. For example, Claude requires specifying a server name and the MCP server URL in its connector configuration.

{
  "mcpServers": {
    "Commvault": {
      "command": "npx",
      "args": ["mcp-remote", "HOST:PORT/mcp", "--header", "Authorization: <secret stored in server keyring>"]
    }
  }
}

{
  "mcpServers": {
    "Commvault": {
      "command": "cmd",
      "args": ["/c", "npx", "mcp-remote", "HOST:PORT/mcp", "--header", "Authorization: <secret stored in server keyring>"]
    }
  }
}

{
  "mcpServers": {
    "Commvault": {
      "command": "npx",
      "args": ["mcp-remote", "HOST:PORT/mcp", "--header", "Authorization: <secret stored in server keyring>", "--allow-http"]
    }
  }
}

{
  "mcpServers": {
    "Commvault": {
      "command": "C:\\YOUR\\PATH\\TO\\commvault-mcp-server\\.venv\\bin\\python",
      "args": [
        "C:\\YOUR\\PATH\\TO\\commvault-mcp-server\\src\\server.py"
      ]
    }
  }
}

{
  "mcpServers": {
    "Commvault": {
      "command": "C:\\YOUR\\PATH\\TO\\commvault-mcp-server\\.venv\\Scripts\\python.exe",
      "args": [
        "C:\\YOUR\\PATH\\TO\\commvault-mcp-server\\src\\server.py"
      ]
    }
  }
}

When deployed behind a reverse proxy or load balancer, configure TRUSTED_PROXY_IPS environment variable with comma-separated proxy IP addresses to enable per-client rate limiting using the X-Forwarded-For header. For example:

export TRUSTED_PROXY_IPS="10.0.0.1,10.0.0.2,192.168.1.100"

The Salesforce integration enables browsing of backed-up Salesforce records stored in Commvault. It provides two tools:

Prerequisites

1. Environment Variable: Set ENABLE_SALESFORCE_TOOLS=true in your environment
2. Commvault Salesforce Backup: At least one Salesforce organisation must be configured and backed up in Commvault

Usage Example

To browse backed-up Account records for a Salesforce org:

Get all backed-up Account records for Salesforce org 00D2w000005mBCpEAM

The tool will automatically resolve the org ID to a Commvault client and return the latest backed-up records.

Parameters for get_salesforce_records

The DocuSign backup integration enables backup of completed DocuSign envelopes to a Commvault S3 vault. This integration provides comprehensive document management capabilities including backup, listing, and restore operations.

Prerequisites

1. Environment Variable: Set ENABLE_DOCUSIGN_TOOLS=true in your environment
2. Commvault S3 Vault: Configure an S3 endpoint in Commvault
   • Learn more: Getting Started with S3 Vault
3. DocuSign API Access: Valid DocuSign integration credentials

Configuration Files

Create the following files in the config/ directory:

1. DocuSign Configuration (docusign_config.json)

Based on the template file config/docusign_config_template.json:

{
  "docusign": {
    "integrationKey": "YOUR_INTEGRATION_KEY_HERE",
    "userId": "YOUR_USER_ID_HERE", 
    "authServer": "account-d.docusign.com",
    "scopes": "signature impersonation",
    "basePath": "https://demo.docusign.net/restapi"
  },
  "fromDate": "2024-07-01T00:00:00Z"
}

2. DocuSign Private Key (docusign_key.pem)

Place your DocuSign private key file in the config/ directory as docusign_key.pem.