Gemini CLI

Gemini CLI supports remote Streamable HTTP MCP servers with OAuth. Its default dynamic_discovery mode discovers authorization and token endpoints from Novaplan AI’s metadata.

Before you start, ask Novaplan Support to confirm the approved OAuth app, Client ID, and Client Secret for your workspace.

For coding-agent access and the approved MCP setup, contact Novaplan Support.

Option A: Settings File

Edit ~/.gemini/settings.json:

{
  "mcpServers": {
    "novaplan": {
      "httpUrl": "NOVAPLAN_WORKSPACE_URL/mcp",
      "oauth": {
        "enabled": true,
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "$NOVAPLAN_CLIENT_SECRET",
        "redirectUri": "http://localhost:7777/oauth/callback",
        "scopes": [
          "openid", "profile", "email", "offline_access",
          "semantic:write",
          "conversation:write", "conversation:chat",
          "kb:read", "team:read", "user:read", "config:read"
        ]
      }
    }
  }
}

httpUrl selects Streamable HTTP. The url key selects SSE in Gemini CLI and is not correct for Novaplan AI’s /mcp endpoint. Adjust the scopes list to the tools and permissions approved for your OAuth app. Set NOVAPLAN_CLIENT_SECRET in your protected local environment before starting Gemini CLI; Gemini expands $NOVAPLAN_CLIENT_SECRET when it reads the settings file. Keep the actual secret out of shared or committed files.

Register the exact http://localhost:7777/oauth/callback URI in your Novaplan OAuth app. Gemini CLI otherwise chooses a random local callback port, which cannot be pre-registered reliably; the explicit redirectUri above fixes it to port 7777.

Option B: CLI Command

gemini mcp add --scope user --transport http novaplan NOVAPLAN_WORKSPACE_URL/mcp

Then edit ~/.gemini/settings.json to add the oauth block as shown above. --scope user makes the CLI command write to that user settings file; the CLI otherwise defaults to project scope.

Authenticate

Inside Gemini CLI, use the /mcp auth commands:

# List servers and their auth status
/mcp auth

# Authenticate with Novaplan AI (opens browser for login)
/mcp auth novaplan

# Re-authenticate if tokens expire
/mcp auth novaplan

On first connection, Gemini will automatically detect the 401 response, discover the OAuth endpoints, and open a browser for login. Tokens are stored securely in ~/.gemini/mcp-oauth-tokens.json and refreshed automatically.

Manage Servers

# List all configured servers
gemini mcp list

# Remove the server
gemini mcp remove novaplan

# Temporarily disable/enable
gemini mcp disable novaplan
gemini mcp enable novaplan

OAuth Configuration Properties

Property	Required	Description
`clientId`	Yes	OAuth 2.0 Client ID from Novaplan AI
`clientSecret`	No	OAuth 2.0 Client Secret (for confidential clients)
`scopes`	No	OAuth scopes to request
`authorizationUrl`	No	Override authorization endpoint (auto-discovered by default)
`tokenUrl`	No	Override token endpoint (auto-discovered by default)
`redirectUri`	No	Fix the callback URI; otherwise Gemini CLI uses an OS-assigned random localhost port

Current Gemini CLI validates the OAuth callback’s iss (issuer) parameter when an issuer is discovered. If sign-in fails with Missing issuer parameter in response, contact Novaplan AI support. Do not disable issuer validation. Compatibility must be confirmed against the deployed Enterprise OAuth server.

OAuth requires a local browser. It will not work in headless environments, remote SSH without X11 forwarding, or containers without browser access.

Welcome To Novaplan AI

System Overview

Administration

Authentication

AI Providers

Connectors

Integrations

Agents

Toolsets

MCP Server

Developer

Additional Resources

Option A: Settings File

Option B: CLI Command

Authenticate

Manage Servers

OAuth Configuration Properties

​Option A: Settings File

​Option B: CLI Command

​Authenticate

​Manage Servers

​OAuth Configuration Properties

Option A: Settings File

Option B: CLI Command

Authenticate

Manage Servers

OAuth Configuration Properties