> For the complete documentation index, see [llms.txt](https://docs.quilt.bio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.quilt.bio/quilt-platform-administrator/connect.md). # Quilt Connect Server > Connect Server requires Quilt Platform version 1.68 or later. **Quilt Connect Server** is an identity provider and gateway that enables external services to securely interact with your Quilt data and perform actions on behalf of your users. Connect Server: * Authenticates requests using your organization's identity provider * Issues session tokens scoped to individual user permissions * Routes requests to authorized services within your AWS environment One such service is the [Platform MCP Server](/quilt-platform-catalog-user/mcp-server.md), which lets AI assistants interact with your Quilt data through natural language. ## Admin Setup Connect Server is disabled by default. To enable it, set the `ConnectAllowedHosts` CloudFormation parameter to a non-empty value. ### CloudFormation Parameters | Parameter | Default | Description | | ----------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ConnectAllowedHosts` | *(empty)* | Comma-separated list of allowed OAuth redirect origins. Empty = disabled. See [Entry formats](#connectallowedhosts-entry-formats) below. | | `ConnectSecurityGroup` | *(empty)* | Optional EC2 security group ID for Connect ALB IP allowlisting. Empty = allow all. | | `CertificateArnConnect` | *(empty)* | Optional ACM certificate ARN for the Connect ALB. Empty = reuses the main stack TLS certificate, which must then cover the Connect host (see [DNS Configuration](#dns-configuration)). | #### `ConnectAllowedHosts` Entry Formats Each comma-separated entry can be one of: | Format | Example | Matches | | ---------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Hostname** | `claude.ai` | `https://claude.ai/*` (HTTPS only) | | **Subdomain wildcard** | `.benchling.com` | `https://.benchling.com/*` — any subdomain at any depth (e.g. `app.benchling.com`, `app.us.benchling.com`); does **not** match the apex `https://benchling.com/*` (HTTPS only; leading dot required) | | **Custom scheme** | `cursor://` | `cursor:///*` (for desktop apps with a custom URI scheme) | | **Localhost** | `localhost` | `http://localhost:/*` and `http://127.0.0.1:/*` (HTTP only; either loopback enables both) | Canonical example covering the common web, desktop, and local MCP clients (loopback first, then suffix wildcards, then alphabetized hostnames and custom schemes): ``` localhost,.benchling.com,.cloud.databricks.com,chat.openai.com,chatgpt.com,claude.ai,claude.com,cursor://,gemini.google.com,vscode.dev,windsurf:// ``` Entries are case-insensitive. Trailing dots on hostnames are ignored. Network schemes (`http://`, `https://`, etc.) are not valid entries and are silently ignored — use a bare hostname (or `.`-prefixed wildcard suffix) for HTTPS clients and a custom scheme (`cursor://`) for desktop clients. ## DNS Configuration After deploying with Connect enabled, create a DNS record for your Connect subdomain (typically `-connect.`). If your hosted zone is in **Route 53**, we recommend an alias record: | Route 53 Field | Value | | -------------- | -------------------------------------------------- | | Record type | `A` (alias) | | Alias target | `ConnectLoadBalancerDNSName` CloudFormation output | | Hosted zone ID | `ConnectLoadBalancerCanonicalHostedZoneID` output | If your DNS is hosted elsewhere, create a `CNAME` record pointing to the `ConnectLoadBalancerDNSName` CloudFormation output. See the [Installation CNAMEs section](/quilt-platform-administrator/installation.md#cnames) for the equivalent catalog DNS records. > **ALB scheme (internal vs. internet-facing).** As of Quilt 1.71, the Connect ALB follows the same scheme as the main catalog load balancer. On an internet-facing stack the Connect endpoint is reachable from the public internet; on an internal stack it is internal — reachable only from within your VPC or over your VPN, like the catalog itself. On internal stacks, local or desktop MCP clients (Cursor, Claude Code, etc.) must therefore run on a network with access to the Connect host. > **TLS certificate:** by default (`CertificateArnConnect` empty) the Connect ALB reuses the main stack certificate (`CertificateArnELB`), which must then cover the Connect host (the `ConnectHost` output) — via an explicit Subject Alternative Name or a wildcard at the matching level (`*` matches a single label only). If it does not, set `CertificateArnConnect` to a certificate that does; otherwise DNS resolves but HTTPS fails with a certificate name mismatch. The final Connect Server hostname is available in the `ConnectHost` CloudFormation output. ## OAuth Metadata Connect Server publishes OAuth authorization server metadata at `/.well-known/oauth-authorization-server` and OpenID metadata at `/.well-known/openid-configuration`. The `issuer` value is the Connect Server origin with the explicit HTTPS default port (`https://:443`), and all advertised endpoints (`/auth/token`, `/auth/register`, `/auth/revoke`, `/auth/.well-known/jwks.json`, and the cross-served `/connect/authorize`) include the same explicit `:443`. > **Compatibility note.** Per RFC 3986, `https://host` and `https://host:443` identify the same origin and are equivalent. However, some strict OAuth clients — notably Databricks Apps — perform string-sensitive origin comparisons against the issuer and reject DCR when the issuer omits the default port. Quilt Connect emits `https://:443` to remain compatible with these clients; well-behaved clients that normalize per RFC 3986 are unaffected. ### Protected Resource Identifier Connect Server registers exactly one OAuth `resource` identifier for the Platform MCP server: ``` https:///mcp/platform ``` Connect normalizes inbound `resource` parameters by stripping a trailing `/mcp` before the membership check, so clients that submit the full MCP transport URL (`https:///mcp/platform/mcp`, as ChatGPT does) are accepted alongside clients that derive the canonical resource from [RFC 9728 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/rfc9728) (as Claude.ai and Cursor do). The token `aud` claim is always the canonical `/mcp/platform` identifier regardless of input form. ## IP Allowlisting (Optional) To restrict which IP ranges can reach the Connect Server, create an EC2 security group with inbound rules on port 443 for your trusted CIDR ranges, then pass the security group ID as `ConnectSecurityGroup`. If omitted, the Connect ALB accepts traffic from any IP. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.quilt.bio/quilt-platform-administrator/connect.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.