Configure the Bold Reports® MCP Server

The Bold Reports® MCP Server uses Bearer token-based authentication to securely validate and authorize requests from MCP-compatible clients. This authentication model ensures that only authorized users and applications can access and perform actions within your Bold Reports® account.

How Authentication Works

Authentication is handled through Bold Reports® Bearer tokens, providing a secure and reliable way to connect development tools and automation workflows to the Bold Reports® MCP Server.

When a client connects to the MCP Server:

  • Every request must include a valid Bold Reports® Bearer token.
  • The token identifies the authenticated user.
  • Access permissions are automatically enforced based on the user's assigned roles and permissions.
  • All actions are performed within the context of the authenticated user's account.

This ensures that automation systems can only access resources and perform operations that the authenticated user is authorized to use.

User Scope and Permissions

The MCP Server respects all existing Bold Reports® permission controls.

Based on the authenticated Bearer token, systems can access only the resources available to that user, including:

  • Reports and Report Categories.
  • Datasources and Datasets.
  • Schedules and Delivery.
  • Users and Groups.
  • Permissions and Access Control.
  • Settings and Configuration.
  • Other account-specific resources.

Any actions performed through the MCP Server follow the same permission boundaries enforced within the Bold Reports® application.

Prerequisites

Before configuring the MCP server, ensure that:

  • Publicly hosted Bold Reports® site - You have access to a publicly hosted Bold Reports® instance (not on-premise).

  • Valid Bearer token - You have a valid API token or authorization mechanism configured.

  • Site accessible over internet - The report site is accessible over the internet.

  • Tenant-specific site URL - The tenant/site URL is available.

Note: Currently, MCP support is available only for publicly hosted Bold Reports® sites. On-premise (local build) deployments are not supported at this time.

Configure Authentication

Follow these steps to configure your MCP client and authenticate it with the Bold Reports® MCP Server.

Step 1: Generate Token

Generate a Bearer token from your Bold Reports® user profile. For detailed steps, see Generate an Authentication Token for Bold Reports® Server.

The token will be used to authenticate requests between your MCP client and the Bold Reports® MCP Server.

Step 2: Configure Your MCP Client

Add the MCP server to your client and include the Bearer token in the client configuration.

Supported clients include:

  • Visual Studio 2022
  • Visual Studio 2026
  • Visual Studio Code
  • Syncfusion® Code Studio

For Visual Studio: Add the configuration to your MCP settings and include your Bearer token in the Authorization header.

For Syncfusion® Code Studio: Add the MCP configuration file and include your Bearer token in the Authorization header.

Step 3: Include Token in Requests

Ensure that all MCP requests include the Bearer token in the proper format.

Add the following MCP server configuration to your MCP client. The headers section is where authentication and the target site URL are configured.

{
  "boldreports_mcp": {
    "url": "https://mcp.boldreports.com/api/",
    "type": "http",
    "headers": {
      "Authorization": "Bearer <your-access-token>",
      "X-BoldReports-BaseUrl": "https://{yourdomain}/reporting/api/site/{tenant-name}"
    }
  }
}

Configuration Parameters

Parameter Description
url Bold Reports® MCP server endpoint: https://mcp.boldreports.com/api/
type Communication type. Currently supports http
Authorization Bearer token for authentication in format: Bearer <your-access-token>
X-BoldReports-BaseUrl The Bold Reports® site URL that the MCP server should connect to

Site URL Format

The X-BoldReports-BaseUrl header must contain the tenant-specific Bold Reports® site URL in the following format:

https://{yourdomain}/reporting/api/site/{tenant-name}

Example:

https://demo.boldreports.com/reporting/api/site/site1

Configure the header as:

{
  "X-BoldReports-BaseUrl": "https://{yourdomain}/reporting/api/site/{tenant-name}"
}

Complete Working Example

{
  "boldreports_mcp": {
    "url": "https://mcp.boldreports.com/api/",
    "type": "http",
    "headers": {
      "Authorization": "Bearer eyJhbGciOi...",
      "X-BoldReports-BaseUrl": "https://{yourdomain}/reporting/api/site/{tenant-name}"
    }
  }
}

Test Your Configuration

After configuration, validate your setup works correctly.

Using curl:

curl -X GET "https://mcp.boldreports.com/api/" </span>
  -H "Authorization: Bearer <your-access-token>" </span>
  -H "X-BoldReports-BaseUrl: https://{yourdomain}/reporting/api/site/{tenant-name}"

Expected Responses:

  • 200 OK - Configuration is working correctly.
  • 401 Unauthorized - Invalid or expired token.
  • 404 Not Found - Wrong base URL or unreachable site.

Troubleshooting

Authentication Failure

Problem: "401 Unauthorized" or "Invalid token"

Verification:

  • Token format must be: Bearer <token>
  • Token is not expired.
  • Token has report access permissions.
  • No extra spaces or characters in token.

Solution:

  1. Verify token in your Bold Reports® profile.
  2. Regenerate token if expired.
  3. Check token permissions.

Unable to Connect to Site

Problem: "404 Not Found" or connection error

Verification:

  • Correct X-BoldReports-BaseUrl value.
  • Tenant name is valid.
  • Site is publicly accessible.
  • URL format is correct: https://{yourdomain}/reporting/api/site/{tenant-name}

Solution:

  1. Test URL in browser to confirm it's accessible.
  2. Verify tenant name with your Bold Reports® admin.
  3. Ensure domain spelling is correct.

Security Best Practices

To keep your Bold Reports® account secure, follow these recommendations:

  • Store tokens securely - Use secure credential management systems or environment variables.
  • Never expose tokens publicly - Avoid committing tokens to version control or public repositories.
  • Avoid sharing tokens - Keep tokens private and don't share with unauthorized users.
  • Rotate tokens periodically - Follow your organization's security policies for token rotation.
  • Revoke compromised tokens immediately - Delete and regenerate any exposed tokens without delay.

Important Notes

  • Access permissions are determined entirely by the Bearer token being used.
  • The MCP Server does not grant additional privileges beyond those assigned to the authenticated user.
  • All interactions, actions, and data access are restricted to the authenticated user's scope.
  • Requests made with invalid or expired Bearer tokens will be rejected.

By using Bearer token-based authentication, the Bold Reports® MCP Server provides a secure and controlled way for development tools and automation platforms to interact with your reporting environment.

Next: See Available MCP Tools in Bold Reports® to explore all available tools.