Agentic Data Plane
Preview

Ironclad Managed MCP Server

The Ironclad managed MCP server gives an LLM read and write access to Ironclad, a contract lifecycle management (CLM) platform. Useful for agents that need to find contracts, check signature status, launch new contracts from templates, or list a contract’s executed documents.

After reading this page, you will be able to:

  • Configure the Ironclad managed MCP server with per-user OAuth

  • Pick the right region and scopes for your tenant

  • List, fetch, and launch contract workflows from an agent

What this MCP server does

Per-user OAuth 2.0 (Authorization Code grant). No static API key is stored in the MCP config; each user authorizes their own Ironclad account through AI Gateway’s OAuth flow.

It is not a replacement for the Ironclad web UI for complex workflow management or template authoring.

Prerequisites

Before you create the server, make sure you have:

Get Ironclad credentials

Set up the OAuth app on Ironclad and the matching OAuth Provider in Agentic Data Plane. Register a separate app in each Ironclad environment you use, because apps don’t carry over between environments.

  1. In Ironclad, open your user profile menu and select Company Settings. Open the API tab, then the Applications tab, and click Create new app.

  2. Set the redirect URI to your AI Gateway callback URL (typically https://aigw.<cluster-id>.clusters.rdpa.co/oauth/v1/callback).

  3. Select the following scopes:

    • public.workflows.readWorkflows

    • public.workflows.readSchemas

    • public.workflows.createWorkflows

    • public.workflows.readDocuments

  4. Copy the Client ID and Client Secret.

  5. In Agentic Data Plane, create a custom OAuth Provider with:

    • Authorization endpoint: https://ironcladapp.com/oauth/authorize for North America, https://eu1.ironcladapp.com/oauth/authorize for EU-hosted accounts, or https://demo.ironcladapp.com/oauth/authorize for the demo environment

    • Token endpoint: https://ironcladapp.com/oauth/token, or the eu1 or demo equivalent

    • Scopes: the same four scopes you selected on the Ironclad app

    • The Client ID and a secret-store reference for the Client Secret

Configure

Create a new Ironclad MCP server in Agentic Data Plane:

  1. Open MCP servers in the sidebar.

  2. Click Add MCP server.

  3. Click the Ironclad card in the marketplace picker.

  4. Replace the suggested Name, and optionally add a Description.

  5. In the Ironclad configuration form:

    Field Notes

    region

    IRONCLAD_REGION_NA (default), IRONCLAD_REGION_EU for EU-hosted accounts, or IRONCLAD_REGION_DEMO for sandbox testing.

    OAuth Provider

    The Ironclad OAuth Provider you configured.

    Required scopes

    public.workflows.readWorkflows, public.workflows.readSchemas, public.workflows.createWorkflows, public.workflows.readDocuments. Every required scope must also be in the provider’s scopes. A required scope the provider doesn’t request makes tool calls fail with scope_upgrade_required until each user reconnects and grants it. If the Ironclad app isn’t allowed to grant that scope, every tool call keeps failing.

  6. Click Create server.

Configure from the CLI

Ironclad authenticates per-user through the Ironclad OAuth Provider you configured. Reference that provider in the managed config’s userOauth.providerName field. Ironclad supports per-user OAuth only, so the userOauth block is required. The --remote.user-oauth.provider-name and --remote.user-oauth.required-scopes flags belong to the remote flag group, so they apply to remote servers only.

rpk ai mcp-server create my-ironclad --enabled --managed.config '{
  "@type": "type.googleapis.com/redpanda.mcps.ironclad.v1.IroncladMCPConfig",
  "region": "IRONCLAD_REGION_NA",
  "userOauth": {
    "providerName": "ironclad"
  }
}'

For EU-hosted accounts, use "IRONCLAD_REGION_EU". For sandbox testing, use "IRONCLAD_REGION_DEMO". userOauth.providerName is the resource name of the Ironclad OAuth Provider you registered.

The create form turns Enable code mode on by default for this server type. rpk ai mcp-server create leaves it off unless you pass --code-mode. See Code Mode.

Tools

The Ironclad MCP exposes the following tools:

Tool Description

list_workflows

List contracts with optional status filter and page/per_page pagination. See the caveat after the table.

get_workflow

Get full details of a contract by workflow_id.

list_workflow_schemas

List available contract templates with their field IDs.

create_workflow

Launch a new contract from a template (schema_id + attributes_json).

list_workflow_documents

List documents attached to a contract. It lists documents but doesn’t download them.
Ironclad’s API accepts active, paused, completed, and cancelled as workflow statuses, and returns active workflows when you omit status. The tool’s own description lists other status names, such as signing, that Ironclad’s API reference doesn’t include, so use one of the four documented values. The per_page argument might not change the page size either. Ironclad returns 20 workflows per page by default.

Example: List active contracts

curl -X POST https://aigw.<cluster-id>.clusters.rdpa.co/mcp/v1/my-ironclad \
  -H "Authorization: Bearer <user-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0", "id": 1, "method": "tools/call",
    "params": {
      "name": "list_workflows",
      "arguments": {"status": "active"}
    }
  }'

Troubleshooting

Common symptoms and fixes:

Symptom What to check

connection_required

First call from a user with no stored token. The failed tool result carries the authorization URL. The user completes Ironclad’s OAuth consent flow, the token lands in the vault, and subsequent calls reuse it.

scope_upgrade_required

The server’s required_scopes was extended after users had already consented, so users reconnect to grant them. If it persists after reconnecting, a required scope is missing from the provider’s scopes or from the Ironclad app.

Wrong region results

Confirm the Region field matches your Ironclad tenant. EU-hosted accounts use IRONCLAD_REGION_EU; sandbox tenants use IRONCLAD_REGION_DEMO.

schema_id not found in create_workflow

Run list_workflow_schemas first to get valid IDs for your tenant.

Limitations

This page does not cover:

  • Template authoring: Define templates in the Ironclad web UI, then reference them by schema_id.

  • eSignature flows: Handled inside Ironclad; this MCP launches and reads workflow state.

Next steps