Custom Enterprise MCP Integration Guide
Overview
Custom enterprise access is for in-house assistants and other platforms that support Streamable HTTP MCP. The platform passes a unique identifier for the current member. GuanMCP matches the corresponding Guandata BI user property, and permissions follow the matched user.
Connect a custom enterprise platform
Prerequisites
- Configure centralized access with
MCP_ENTRYPOINT_TOKENandBI_APP_TOKEN. - Ensure the platform dynamically passes a stable, unique identifier such as an employee number.
- Store the same identifier in a Guandata BI user property so it uniquely identifies one enabled user.
Step 1: Define user mapping
| Item | Example | Description |
|---|---|---|
| Identity header | X-Company-User-Id | Header dynamically sent for the current member. |
| Guandata user property key | employee_no | Property that stores the employee number. |
| Property value | E001827 | Identifier that must match exactly and remain unique. |
employee_no is only an example. Replace it with the actual property key. For many users, maintain mappings through an Account Dataset and Account Sync. For a few users, edit user information directly.
Step 2: Configure GuanMCP
MCP_ENTRYPOINT_TOKEN=<MCP service credential>
BI_APP_TOKEN=<Guandata Public API application token>
BI_USER_PROPERTY_HEADER=X-Company-User-Id
BI_USER_PROPERTY_KEY=employee_no
Each service instance supports one mapping. Use separate instances and URLs when platforms use different mappings.
Step 3: Add GuanMCP to the enterprise platform
- Add a Streamable HTTP MCP service with the complete URL, such as
https://mcp.company.com/mcp. - Configure
Authorization: Bearer <MCP service credential>. - Have the platform dynamically populate X-Company-User-Id for the authenticated user.
POST https://mcp.company.com/mcp
Authorization: Bearer <MCP service credential>
X-Company-User-Id: E001827
The identity header must never be fixed or entered by an end user. Do not configure a personal PAT, BI password, or BI_APP_TOKEN in the enterprise AI platform.
Step 4: Verify access
Ask “Show me the datasets I can access” as two members with different permissions and verify that each request contains that member's identifier. Results should match their Guandata BI permissions.
Troubleshooting
User identity is missing
Verify that the platform dynamically sends the header specified by BI_USER_PROPERTY_HEADER. Configuring the header in GuanMCP does not make the upstream platform generate an identifier.
User mapping fails
Compare the request header value with the Guandata property specified by BI_USER_PROPERTY_KEY. Values must match exactly and identify one enabled user.
Different members receive identical results
Verify the identity header changes with the member and that the two users actually have different Guandata BI permissions. Never use one fixed BI account for all members.