The Polytomic MCP server can be used with on premises deployments. By default Polytomic accepts any MCP client that identifies itself in one of two ways:

Client ID Metadata Document (CIMD). The client's ID is an HTTPS URL that serves a JSON document describing the client. Polytomic fetches that document when a user signs in. Claude identifies itself this way.
Dynamic Client Registration (DCR). The client registers itself by calling /oauth/register on your Polytomic URL. Registering doesn't grant any access: the user still has to sign in and approve the connection.

You can turn either method off, or accept only the CIMD clients you list. These settings affect OAuth sign-in only. Users can still connect with a Polytomic API key, using the Polytomic Connector or manual configuration.

This requires Polytomic release rel2026.10.21.02 or later.

Settings

Variable	Default	Effect
`OAUTH_DCR_DISABLED`	`false`	When `true`, `/oauth/register` returns `404`, the OAuth discovery metadata no longer lists a registration endpoint, and every client that registered through DCR is rejected, including clients that registered before you changed the setting.
`OAUTH_CIMD_CLIENT_IDS`	empty (any client)	A comma-separated list of CIMD client ID URLs that may sign in. Polytomic rejects other client IDs without fetching their documents. URLs must match exactly, including any trailing slash.
`OAUTH_CIMD_DISABLED`	`false`	When `true`, every CIMD client is rejected and the discovery metadata reports that CIMD isn't supported.

OAUTH_CIMD_DISABLED and OAUTH_CIMD_CLIENT_IDS can't be used together. Polytomic won't start if both are set.

Allow only Claude

Claude uses two client IDs:

https://claude.ai/oauth/mcp-oauth-client-metadata for claude.ai, Claude Desktop, Claude mobile, and Cowork
https://claude.ai/oauth/claude-code-client-metadata for Claude Code

To accept only Claude, turn off DCR and list both IDs:

OAUTH_DCR_DISABLED=true
OAUTH_CIMD_CLIENT_IDS=https://claude.ai/oauth/mcp-oauth-client-metadata,https://claude.ai/oauth/claude-code-client-metadata

Polytomic fetches each client's metadata document while the user signs in, so the Polytomic containers need outbound HTTPS access to claude.ai.

Turn off OAuth sign-in

Set both OAUTH_DCR_DISABLED=true and OAUTH_CIMD_DISABLED=true to stop accepting any OAuth client. Polytomic then serves no OAuth endpoints at all, and users connect with an API key through the Polytomic Connector or manual configuration.

Setting the variables

With the Helm chart, add the variables under polytomic.extraEnv:

polytomic:
  extraEnv:
    OAUTH_DCR_DISABLED: "true"
    OAUTH_CIMD_CLIENT_IDS: "https://claude.ai/oauth/mcp-oauth-client-metadata,https://claude.ai/oauth/claude-code-client-metadata"

With the ECS Terraform module, use extra_environment:

extra_environment = {
  OAUTH_DCR_DISABLED    = "true"
  OAUTH_CIMD_CLIENT_IDS = "https://claude.ai/oauth/mcp-oauth-client-metadata,https://claude.ai/oauth/claude-code-client-metadata"
}

Existing connections

Changing a setting doesn't revoke access that users have already granted. Each OAuth sign-in issues a Polytomic API key, and those keys keep working until they're revoked. To cut off a client you've disallowed, revoke its keys under Settings → API keys.