Glean

Add Deliverd to Glean as an MCP server, so a Glean agent asks the right person, or your organisation's policy, before it acts.

Glean admins can add any MCP server as a source of actions, and Deliverd is an MCP server. Once it is added, a Glean agent can ask a named person to approve an action, or check your organisation's policy first, and the decision is recorded in Deliverd.

Before you start

A Glean admin account, to add the server in the Admin Console.
A Deliverd organisation that the people using the agent belong to.
Your Glean server address. It is shown at app.glean.com/admin/about-glean and usually looks like https://<instance>-be.glean.com.

Connect

1
Get a client ID
Glean's form asks for a client ID, so register Glean with Deliverd once for your instance. Run the first command below with your own instance name in place of <instance>. It returns a client_id (it starts dlvc_). No secret is needed: Glean uses PKCE.
2
Add the server in Glean
In the Glean Admin Console, go to Platform → Actions → Add → Import tools from MCP server. Name it Deliverd and fill in the form with the settings below.
3
Set up sign-in
Choose OAuth User and use the client ID from step 1. Leave the client secret empty. Leave scopes empty, or enter offline_access, to get the standard set; each person still sees and approves them.
4
Choose the tools
Save, and Glean lists the tools. Under Edit settings, turn on the ones your agents need for Agents (and for the Assistant if you want them in chat). request_approval, get_approval, check_gate and get_gate cover asking first.
5
Sign in
The first time someone uses a Deliverd tool, Glean sends them to Deliverd to choose their organisation and approve. There is no key to paste.

Register Glean (step 1)

curl -X POST https://deliverd.dev/api/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Glean",
    "redirect_uris": ["https://<instance>-be.glean.com/tools/oauth/verify_code"],
    "token_endpoint_auth_method": "none"
  }'

Glean's form (steps 2 and 3)

Server URL:         https://deliverd.dev/api/mcp
Transport:          Streaming HTTP
Authentication:     OAuth User
Authorization URL:  https://deliverd.dev/oauth/authorize
Token URL:          https://deliverd.dev/api/oauth/token
Client ID:          the dlvc_… value from step 1
Client secret:      (leave empty)
Scopes:             (leave empty, or offline_access)

Use it in an agent

In Glean's agent builder, add a Plan and Execute step before the action that needs sign-off (Glean only offers MCP tools in those steps). Tell it, in plain words, what to ask and who decides, for example: 'Before updating the customer record, call request_approval with the change and the reason, then call get_approval and continue only if it is approved.'

Tool	Use it to
`request_approval`	Ask named people to approve an action, with what is being done and why.
`get_approval`	Read the decision back. Act only when it is approved.
`check_gate`	Ask your organisation's policy first. It allows the action, refuses it, or sends it to a person.
`get_gate`	Read a gate back while a person decides. Act only when `canExecute` is true.

For the security review

OAuth 2.1 authorization code with PKCE (S256 only). Each person signs in as themselves, so every request and decision is tied to a named person.
Glean's callback, https://<instance>-be.glean.com/tools/oauth/verify_code, is recognised by Deliverd, so it is allowed in organisations that only allow recognised apps. A Glean instance on a custom domain still connects, but its people are asked to confirm the address when they sign in.
A code is only ever sent to the redirect address registered for the client ID, matched exactly.
Each tool says whether it only reads, changes something, or can reach outside the organisation.

Before you start#

Connect#