# The TableauOps MCP connector

> Connect your AI to TableauOps to build and publish hosted Tableau viz extensions. The endpoint, the two auth modes, and connecting in Claude or Cursor.

Canonical: https://ext.tableauops.com/knowledge/mcp-connector
Updated: 2026-09-18
Author: Eric Summers


The TableauOps MCP connector is a remote Model Context Protocol server that lets your own AI (Claude Desktop, Claude Code, Cursor, or any MCP client) publish and manage hosted Tableau viz extensions without opening a browser. The division of labour is deliberate: your AI writes the component, which it is good at, and TableauOps compiles and hosts it and hands back a `.trex` to load into Tableau.

## What it lets an agent do

Once connected, the AI gains a set of tools to publish a component as a real hosted viz extension, update one it already published, list and read your extensions, validate a component without publishing (a dry run to iterate to a clean state), make an extension public, and produce a Tableau Public embed. It also exposes an `authoring-guide` resource, the exact component contract, which the AI should read before it writes. This page covers connecting; for the full tool list see [the MCP tools reference](/knowledge/mcp-tools-reference), and for the source contract see [the component contract](/knowledge/component-contract).

## The endpoint and transport

The server lives at `POST /mcp` (`https://ext.tableauops.com/mcp`). It speaks MCP over Streamable HTTP: plain JSON-RPC 2.0, one request in, one JSON response out. There is no server-initiated SSE stream, so a `GET /mcp` from a browser returns the human how-to page and a client probing for a stream gets a 405, which the spec allows. It negotiates protocol versions `2025-06-18` (the default), `2025-03-26`, and `2024-11-05`.

## Two auth modes

The server authenticates a request one of two ways, and the account rides on every request so the server stays fully stateless.

**OAuth 2.1 with PKCE** is the one-click path. The server advertises a `/.well-known/oauth-protected-resource` discovery document (via a `WWW-Authenticate` header on an unauthenticated request), which lets an OAuth-capable client find the authorization server and start the Connect flow. You sign in with your TableauOps account and approve, and the client stores an access token. No token to copy, no headers to set.

**An `exh_` deploy token as a Bearer header** is the token path, best for CI or a headless setup. It is the same account deploy token the ext-host CLI uses, sent as `Authorization: Bearer exh_…`. See [deploy tokens and the CLI](/knowledge/deploy-token-and-cli) to mint one.

## Connecting it

In **Claude Desktop or claude.ai**: open Settings, Connectors, Add custom connector, name it TableauOps, and paste `https://ext.tableauops.com/mcp`. Leave the OAuth client on "register one automatically" and add no request headers. Click Add, then Connect, sign in and Approve, and switch the connector on in a chat.

In **Claude Code or another CLI**, use OAuth in the browser:

```bash
claude mcp add --transport http tableauops https://ext.tableauops.com/mcp
```

Or skip OAuth with a deploy token, for CI or headless use:

```bash
claude mcp add --transport http tableauops \
  https://ext.tableauops.com/mcp \
  --header "Authorization: Bearer exh_..."
```

The same endpoint works in Cursor and any other MCP client that speaks Streamable HTTP.

## FAQ

### What is the MCP endpoint URL?

`https://ext.tableauops.com/mcp`, over Streamable HTTP (JSON-RPC 2.0 on `POST`). Opening it in a browser shows the how-to page; MCP clients POST to it.

### Do I need an API key or headers to connect?

No. The one-click path is OAuth: register the connector, sign in to TableauOps, and approve, with no key and no headers. Only the CI or headless path uses a header, and that is your existing `exh_` deploy token as a Bearer credential.

### Can it see my Tableau data?

No. The connector authorizes against your TableauOps account and can only publish and manage extensions on it. It sees your account, not the data inside your Tableau.

### Should the AI read anything before publishing?

Yes. It should read the `authoring-guide` resource once, which is the exact component contract (a function named `Component`, the `// viz:` and `// fields:` metadata lines, no imports). The `validate_extension` tool is a dry run to reach a clean state before publishing.


---
Try it live: Connect the MCP server — https://ext.tableauops.com/mcp