Skip to main content

AI clients

AI clients let people in your organization use Biggy from the AI tools they already work in, such as Claude, Cursor, ChatGPT, and more. 

When enabled, each person connects their own AI tool to Biggy, using their credentials so Biggy only ever exposes what that person's role already allows. As an admin, you control whether AI clients are allowed, which tools may connect, what Biggy exposes to them, and whether they can propose actions.

The page is available in the web app at Manage > Integrations > AI Clients. 

The page is divided into five tabs: 

Key features

  • Per-client allow lists so you control which AI tools may connect.

  • Granular control over which tool families the MCP server permits, from full agents to narrow read tools.

  • Optional, approval-gated actions through the biggy:act scope.

  • Enterprise SSO through Okta Cross App Access for browserless, seamless sign-in.

  • Ready-to-paste rollout guides and brand assets for admins rolling out to their organization.

Policy Tab

The Policy tab holds the organization-wide settings that control whether and how AI tools connect.

Allow AI clients

AI clients are off by default. When on, people in this organization can connect their AI tools and act as themselves through Biggy.

In the Policy tab Availability section, enable Allow AI clients. This enables MCP and A2A access for the organization.

Disabling ends all active connections

Existing connections stop working when Allow AI clients is disabled. Only disable it when you intend to cut access for everyone.

Allowed clients

By default, all AI tools are allowed. Use the Allowed clients section to limit which tools may connect.

  1. In the Allowed clients section, open the Clients dropdown. 

  2. Select the specific clients you want to allow. Leave the list empty to allow every client. The following options are available:

    1. Claude

    2. Claude Code

    3. Cursor

    4. ChatGPT

    5. Codex

    6. VS Code

    7. Gemini

    8. Copilot Studio

    9. Windsurf

    10. ServiceNow

    11. Agentforce

    12. Amazon Bedrock

    13. Other (Clients Biggy cannot identify, such as self-hosted or unknown tools)

  3. Click Save.

Choose what AI clients can reach

The What AI clients can reach section determines which tool families the MCP server registers. Every person still only sees what their Biggy role allows.

The following options can be enabled or disabled:

  •  Ask Biggy: The full agent as one tool (ask_biggy). Disabling this leaves only the narrow tools below.

  •  Direct tools: Narrow read tools for integrations, such as search_knowledge and get_incident.

  •  Workflows: Published workflows that can be run from the AI tool.

  •  Skills as prompts: Enabled skills formatted as a prompt that the AI tool can insert into a conversation.

Actions

Actions are off by default, so AI clients can only read and propose. When the Allow actions with approval (biggy:act) option is enabled, people whose connection carries the biggy:act scope get the ask_biggy_act tool. Every action still pauses until the action is approved.

Biggy may create tickets, page people, post updates, and run workflows from an AI client. Each action runs only after the person approves it in their client or on the Biggy approval page. 

Actions never bypass a person's role. Biggy roles still determine what someone can approve.

Connections

The Connections tab lists every AI tool connected to this organization, including who connected it, how, and when it was last used.

Use the Client filter to narrow the list to a specific AI tool. Use the Status filter to show only Active or Revoked connection states.

The count in the top-right corner shows how many connections match the current filters. When no tools are connected, the tab shows an empty state and directs you to the connection flow to get started. 

Revoking a connection prevents that connection from working, including any future Enterprise SSO token exchanges associated with it.

Registered clients

Most AI tools register themselves when a person connects. The Registered clients tab manages OAuth clients for platforms that cannot register themselves. These include machine identities bound to roles and confidential clients that need a client ID and secret up front.

The tab header shows the endpoints for your region.

Register a client only when a platform asks for one

Most AI tools register themselves the first time a person connects. Register a client here only for enterprise platforms that require a pre-registered client ID and secret.

To register a new client:

  1. Go to the Registered clients tab.

  2. Click Register client.

  3. In the Register an OAuth Client window, populate the following information:

    Field

    Description

    Client type

    Select the OAuth client type. The following options are available:

    • Agent connection: A machine identity (client_credentials) bound to Biggy roles. Used for platforms that call Biggy without a person signing in.

    • Pre-registered client: A confidential OAuth client for platforms that demand a client ID and secret up front, such as Gemini Enterprise or Copilot Studio manual OAuth. Users still sign in and consent individually.

    Name

    Enter a descriptive name for the client.

    Platform

    Select the client platform. 

    Roles

    This option only appears if you select Agent connection as the client type.

    Select the roles the connection will abide by. You can only select roles your account already has.

    Redirect URIs

    This option only appears if you select Pre-registered client as the client type.

    Enter the redirect URIs for the client.

    Enter one per line, exactly as shown in its platform.

    Do not require PKCE

    This option only appears if you select Pre-registered client as the client type.

    Check the box if your platform cannot send a code challenge. (For example, Gemini Enterprise). 

    Note that requesting offline_access still requires PKCE; document that the platform should not request it.

  4. Click Create Client. 

  5. Copy the Client ID and Secret. The secret will only be displayed once on this screen after the client is registered.

Enterprise SSO

The Enterprise SSO tab lets your identity provider sign users into their AI tools without a browser consent step. 

Set the identity provider

In the Identity provider section, enter the details Biggy uses to trust and verify assertions from your IdP.

  •  Issuer: The iss claim your IdP puts on identity assertions. This value is unique across organizations. For example, https://acme.okta.com.

  •  JWKS URI: The public signing keys Biggy verifies assertions against. Biggy fetches and caches them server-side. For example, https://acme.okta.com/oauth2/v1/keys. Click Test JWKS to confirm Biggy can read the keys.

  •  Audience (optional): Only set this when the IdP cannot use the OAuth issuer above as the assertion aud. For example, https://app.biggy.io.

User mapping

The User mapping section controls how an asserted identity becomes a Biggy user in this organization.

  •  Email claim: The claim on the assertion that carries the person's email. Biggy matches it without case sensitivity against Biggy users. The default is email.

  •  Create users automatically: When enabled, an asserted person without a Biggy account is created with the Standard User role. When off, unknown people are refused until an admin invites them.

Set up Okta Cross App Access

The Set up Okta Cross App Access section describes what the IdP administrator configures. Biggy is the resource application, and the AI tool, such as Claude or ChatGPT, is the requesting application.

  1. In Okta, add Biggy as a resource application and the AI tool as a requesting application, then create a Cross App Access connection between them.

  2. Set the connection's audience to the OAuth issuer below, and grant it to the users or groups who may use the AI tool with Biggy.

  3. Make sure the ID token or assertion carries the email claim configured above for those users.

  4. Save the issuer and JWKS URI on this page. Test JWKS confirms Biggy can read the keys.

    At sign-in, the AI tool exchanges its Okta ID token for an ID-JAG (typ oauth-id-jag+jwt) and posts it to the token endpoint as assertion with grant_type set to jwt-bearer and its client_id. Biggy answers with a bearer access token for the MCP server, and no consent page is shown.

Use the reference values shown in the UI when you configure the connection in Okta.

For more detail, see the Okta Cross App Access docs and the ID-JAG specification.

Tokens issued this way are access-token-only, with no refresh token, and last as long as any other AI-client token. The tool repeats the exchange when it needs a new one. Revoking a connection on the Connections tab, or removing this configuration, stops the next exchange.

Rollout guides

The Rollout guides tab gives admins the setup steps for platforms that people cannot add themselves. Claude, Cursor, ChatGPT, VS Code, Codex, and Gemini CLI require no admin setup: each person connects as themselves from a single page in Biggy. The guides on this tab are only for platforms that an admin must configure. 

Click Preview what your users see to open the connection flow as your users experience it.

Platform setup guides

The following platforms need an admin to configure them. The endpoints in each guide are already filled in for this region. The following guides are available in the UI:

Claude Team and Enterprise

Use the instructions below for a Claude Owner or Primary Owner. Members cannot add custom connectors themselves.

  1. Open Organization settings, then select Connectors (https://claude.ai/admin-settings/connectors).

  2. Go to Add > Custom > Web.

  3. Enter the name and MCP server URL as shown in the UI and save.

  4. Members then open Settings, select Connectors, find Biggy, and click Connect to sign in as themselves.

Leave the OAuth client id and secret empty. Claude discovers Biggy through client-ID metadata (CIMD).

See the Claude docs for more details. 

ChatGPT Business and Enterprise

Use the instructions below for a ChatGPT workspace admin.

  1. Go to Workspace settings > Permissions & Roles > Connected Data and turn on Developer mode.

  2. Open Apps (or Connectors), click Create, enter the name and MCP server URL as shown in the UI, choose OAuth, and save the draft.

  3. Test the draft, then publish it to the workspace.

  4. For Enterprise: assign the app to the roles or groups that should see it (per-app RBAC).

Users whose email is not verified in Biggy identity fail the ChatGPT Enterprise domain restriction. Ask them to sign in to Biggy once through SSO first.

See the ChatGPT docs for more details.

Microsoft Copilot Studio

Use the instructions below for a maker with access to the agent, plus a Biggy admin for the A2A path.

  1. MCP: open the agent, then go to Tools > Add a tool > New tool > Model Context Protocol, enter the name and MCP server URL, and choose OAuth 2.0, then Dynamic discovery.

  2. To use manual OAuth instead of dynamic discovery, register a pre-registered client on the Registered clients tab with the Copilot Studio redirect URI as shown in the UI, then paste its ID and secret into the wizard.

  3. A2A: open the agent, then go to Agents > Add agent > Connect to an external agent, paste the A2A endpoint URL, and authenticate with an agent connection (Registered clients tab, Agent connection kind).

The custom-connector (Power Platform) route uses the OpenAPI YAML available on the AI tools page under Copilot Studio.

See the Microsoft Copilot docs for more details.

Gemini Enterprise

Use the instructions below for a Gemini Enterprise admin.

  1. On the Registered clients tab, register a pre-registered client with the redirect URI below and PKCE not required.

  2. In Gemini Enterprise, add a custom MCP server data store with the MCP server URL as shown in the UI, and the client id and secret you just created.

  3. Do not request offline_access for this client. Biggy requires PKCE whenever offline_access is requested, so Gemini Enterprise users re-authenticate when their token expires.

See the Gemini Enterprise docs for more details.

ServiceNow AI Agent Fabric

Use the instructions below for a ServiceNow admin with AI Agent Fabric.

  1. Go to AI Agent Fabric > Add > External > A2A.

  2. Create a provider with the agent card URL shown in the UI. ServiceNow reads the endpoint and capabilities from the card.

  3. For authentication, use an OAuth 2.1 credential alias with an agent connection from the Registered clients tab, or an API-key alias with a Biggy service key.

See the ServiceNow AI Agent Fabric docs for more details.

Biggy brand assets

The Biggy brand assets section provides downloadable icons and the logo for connector listings, plugin manifests, and store submissions. Assets are served from your data region's MCP host. 

Every size is generated from the same mark, so listings look identical everywhere. 

In this section: