Skip to main content

Make your first governed call

You connect an MCP client to your environment and ask it for the weather. PolicyArc checks the call against policy, forwards it to Open-Meteo, and records it. At the end you find the call under Access Activity in the Admin Portal.

This page is step 5 of the First environment track.

Before you start​

  • An environment with an identity provider and the Open-Meteo Weather connector. First environment sets up both.
  • Claude Code on your machine. For another client, follow its page under Connect clients in step 1 and come back for step 2.

Call the weather tool​

Total time: 4 min

  1. Add your environment to Claude Code

    1 min

    We have not run this step end to end yet.

    In the dashboard, open your environment and select the Connect MCP tab. Under Pick your client, choose Claude Code and copy the command. It has this shape.

    claude mcp add policyarc https://your-environment.example/gateway/mcp --transport http

    Run the copied command in a terminal. Then list your servers.

    claude mcp list

    You should see. claude mcp list shows policyarc with your environment's /gateway/mcp URL.

  2. Ask for the weather and sign in

    2 min

    We have not run this step end to end yet.

    Start Claude Code and ask this.

    Use the policyarc current_weather tool for latitude 43.65 and longitude -79.38.

    The first call has no token, so the gateway answers 401. Claude Code opens your browser at the sign-in page of the identity provider you connected. Sign in. Claude Code receives a token, retries the call, and shows the result. The tool is listed as weather-openmeteo__current_weather, the resource name followed by the tool name.

    You should see. Claude Code prints current conditions for Toronto: temperature, wind speed and a weather code.

  3. Find the call under Access Activity

    1 min

    Open the Admin Portal from your environment page with Open admin portal. Under Operate, select Access Activity. The newest rows belong to your call.

    • An allowed row for /gateway/weather-openmeteo/v1/forecast. It shows your client's id and as followed by your user id. Select the row to see the method, the request id and the policy decision.
    • An allowed row for /introspect right before it. That is the gateway asking the authorization server whether your token may make this call.
    • Rows for /authorize, /callback and /token from your sign-in. Claude Code identifies itself with a client ID metadata document, so there is no /register row.

    Note your user id. The next page uses it.

    You should see. An allowed row for /gateway/weather-openmeteo/v1/forecast that reads as followed by your user id.

What happened​

The gateway is the policy enforcement point. It sits in front of the connector and refuses any call without a valid token. Your client found the authorization server from the 401 and sent you to sign in. Claude Code needs no registration, because the authorization server reads its client ID metadata document. The authorization server issued a token for the scopes your environment allows. On each tool call the gateway sends that token to the authorization server's introspection endpoint, which re-runs policy for this tool before the gateway forwards the request to Open-Meteo.

Check the gateway without a client​

You can see the first half of that exchange with curl. Set your environment URL first. It is the address in your browser when you open the Admin Portal, without the /admin path.

POLICYARC_URL="${POLICYARC_URL:?set POLICYARC_URL to your environment URL}"
headers=$(curl -s -o /dev/null -D - -X POST "$POLICYARC_URL/gateway/mcp" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}')
printf '%s\n' "$headers" | grep -i -E '^HTTP|^www-authenticate'
printf '%s\n' "$headers" | grep -q -E '^HTTP/[0-9.]+ 401' || { echo 'Expected HTTP 401' >&2; false; }
printf '%s\n' "$headers" | grep -q -i '^www-authenticate: Bearer .*resource_metadata=' || { echo 'Expected a WWW-Authenticate header with resource_metadata' >&2; false; }

The response is 401 with a WWW-Authenticate header that points at your environment's protected resource metadata. MCP clients read that header to find where to sign in.

HTTP/1.1 401
WWW-Authenticate: Bearer resource_metadata="https://your-environment.example/.well-known/oauth-protected-resource"

Check your work​

Check your work

If the call fails, see Troubleshooting.