The TableauOps MCP connector is a remote Model Context Protocol server that lets your own AI (Claude Desktop, Claude Code, Cursor, or any MCP client) publish and manage hosted Tableau viz extensions without opening a browser. The division of labour is deliberate: your AI writes the component, which it is good at, and TableauOps compiles and hosts it and hands back a .trex to load into Tableau.
#What it lets an agent do
Once connected, the AI gains a set of tools to publish a component as a real hosted viz extension, update one it already published, list and read your extensions, validate a component without publishing (a dry run to iterate to a clean state), make an extension public, and produce a Tableau Public embed. It also exposes an authoring-guide resource, the exact component contract, which the AI should read before it writes. This page covers connecting; for the full tool list see the MCP tools reference, and for the source contract see the component contract.
#The endpoint and transport
The server lives at POST /mcp (https://ext.tableauops.com/mcp). It speaks MCP over Streamable HTTP: plain JSON-RPC 2.0, one request in, one JSON response out. There is no server-initiated SSE stream, so a GET /mcp from a browser returns the human how-to page and a client probing for a stream gets a 405, which the spec allows. It negotiates protocol versions 2025-06-18 (the default), 2025-03-26, and 2024-11-05.
#Two auth modes
The server authenticates a request one of two ways, and the account rides on every request so the server stays fully stateless.
OAuth 2.1 with PKCE is the one-click path. The server advertises a /.well-known/oauth-protected-resource discovery document (via a WWW-Authenticate header on an unauthenticated request), which lets an OAuth-capable client find the authorization server and start the Connect flow. You sign in with your TableauOps account and approve, and the client stores an access token. No token to copy, no headers to set.
An exh_ deploy token as a Bearer header is the token path, best for CI or a headless setup. It is the same account deploy token the ext-host CLI uses, sent as Authorization: Bearer exh_…. See deploy tokens and the CLI to mint one.
#Connecting it
In Claude Desktop or claude.ai: open Settings, Connectors, Add custom connector, name it TableauOps, and paste https://ext.tableauops.com/mcp. Leave the OAuth client on "register one automatically" and add no request headers. Click Add, then Connect, sign in and Approve, and switch the connector on in a chat.
In Claude Code or another CLI, use OAuth in the browser:
claude mcp add --transport http tableauops https://ext.tableauops.com/mcp
Or skip OAuth with a deploy token, for CI or headless use:
claude mcp add --transport http tableauops \
https://ext.tableauops.com/mcp \
--header "Authorization: Bearer exh_..."
The same endpoint works in Cursor and any other MCP client that speaks Streamable HTTP.
#FAQ
#What is the MCP endpoint URL?
https://ext.tableauops.com/mcp, over Streamable HTTP (JSON-RPC 2.0 on POST). Opening it in a browser shows the how-to page; MCP clients POST to it.
#Do I need an API key or headers to connect?
No. The one-click path is OAuth: register the connector, sign in to TableauOps, and approve, with no key and no headers. Only the CI or headless path uses a header, and that is your existing exh_ deploy token as a Bearer credential.
#Can it see my Tableau data?
No. The connector authorizes against your TableauOps account and can only publish and manage extensions on it. It sees your account, not the data inside your Tableau.
#Should the AI read anything before publishing?
Yes. It should read the authoring-guide resource once, which is the exact component contract (a function named Component, the // viz: and // fields: metadata lines, no imports). The validate_extension tool is a dry run to reach a clean state before publishing.