Authentication error trying to use MCP in DX O2
Article ID: 448114
Updated On:
Products
Issue/Introduction
Getting a failed authorization when trying to run the mcp commands:
'Unauthorized: You do not have permission to access tool 'list_services'' Retrying with X-AuthorizationView: VIEWALL ...
[WARN] Tool invocation still denied with X-AuthorizationView: VIEWALL set ('Unauthorized: You do not have permission to access tool 'list_services'').
This is the complete output:
The pre check passes the given known requirements. C:\DX\claude\projects\o2mcp\work> .\o2mcp_check-prereq.ps1O2 MCP - Pre-Flight Connectivity Check (Windows)Config file: C:\DX\claude\projects\o2mcp\work\config.jsonReport file: C:\DX\claude\projects\o2mcp\work\o2mcp_check-prereq.txt
=============================== PRE-CHECK: Configuration===============================
[ OK ] PowerShell 7.6.3 (no external curl/jq dependency needed)
[ OK ] config.json found at C:\DX\claude\projects\o2mcp\work\config.json
[ OK ] config.json is valid JSON
=============================== CHECK 1: Connection to O2 (TAS endpoint)===================================
[ OK ] DNS resolves O2 host 'apmgw.dxi-na1.saas.broadcom.com'
[ OK ] TCP connection to apmgw.dxi-na1.saas.broadcom.com:443 succeeded
[ OK ] HTTPS handshake to https://apmgw.dxi-na1.saas.broadcom.com succeeded (HTTP 401)
=============================== CHECK 2: Connection to O2 MCP endpoint===================================
[ OK ] DNS resolves MCP host 'apmgw.dxi-na1.saas.broadcom.com'
[ OK ] TCP connection to apmgw.dxi-na1.saas.broadcom.com:443 succeeded
[ OK ] MCP endpoint responded HTTP 200 to an authenticated initialize request - token accepted
============================== CHECK 3: TenantToken validity ================================
[ OK ] TenantToken JWT payload decoded successfully Token subject: [email protected] Tenant name (config.json): broadcom-bc Cohort Id (config.json): EA518FB5-XXXXXXXXXX- 695896
[WARN] TenantToken JWT has no 'exp' claim - could not verify expiration
=============================== CHECK 4: Token Permanence (live O2 API validation)===============================
[ OK ] TenantToken is PERMANENT (no 'exp' claim) - confirmed live against the O2 API (gateway authenticated the token; tool-invocation was denied at the application layer ('Unauthorized: You do not have permission to access tool 'list_services'') - a separate, tenant-side entitlement, not a token-validity issue)
=============================== CHECK 5: Authorization Failure Diagnostics (401/403 guidance)=======================================
Baseline tools/call denied at the application layer: 'Unauthorized: You do not have permission to access tool 'list_services'' Retrying with X-AuthorizationView: VIEWALL ...
[WARN] Tool invocation still denied with X-AuthorizationView: VIEWALL set ('Unauthorized: You do not have permission to access tool 'list_services''). Per O2 MCP troubleshooting guidance, this points to a tenant-side entitlement/view-scope gap rather than a token problem - try a specific universe view id (set O2.AuthorizationView in config.json) or grant MCP tool-invocation permission in Settings > Manage Tokens
=============================== SUMMARY===========================================
Passed: 11 Warnings: 2 Failed: 0
All required checks passed (review warnings above).PS C:\DX\claude\projects\o2mcp\work> Called o2mcplist_metrics still fails with the same error:Unauthorized: You do not have permission to access tool 'list_metrics'This matches what Check 4/5 in the updated o2mcp_check-prereq scripts already surfaced — the bearer token itself is valid and authenticated (confirmed live), and adding X-AuthorizationView: VIEWALL doesn't change it.
Environment
DX O2, since version 26.7.1
Resolution
Product Management confirms the feature is not yet enabled.
Additional Information
It will be enabled for tenant admins, no ETA.
Feature documented here:
https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-operational-observability/saas/generative-ai/dxo2-mcp-server.html#GUID-f6284db6-c004-4297-ab9b-49584a5bed81-en_AvailableTools
Feedback
