Claude Desktop MCP setup for rConfig: local bridge or custom connector
Claude Desktop can reach rConfig in two ways. The local bridge runs on your computer and connects to rConfig from inside your network, so it works with any rConfig server you can reach from your desk. A custom connector is set up in Claude’s settings and connects from Anthropic’s cloud, so rConfig must be reachable from the internet. Most teams with an on-premises rConfig want the bridge.
Best for: engineers and managers who prefer a chat window to a terminal, writing up changes and audit answers, quick questions about a device.
Which route to use
Local bridge (mcp-remote) |
Custom connector | |
|---|---|---|
| Connects from | Your computer | Anthropic’s cloud |
| rConfig on a private address | Works | Doesn’t work |
| Needs | Node.js on the computer | A public HTTPS path to /mcp, and the Request headers beta in your organisation |
| Token | Your own, in a local file | Stored by Claude, shared by everyone who uses the connector |
| Also works in claude.ai | No | Yes |
Local bridge
Edit Claude Desktop’s config file, then restart the app. The file is at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS and %APPDATA%\Claude\claude_desktop_config.json on Windows.
{ "mcpServers": { "rconfig": { "command": "npx", "args": [ "-y", "mcp-remote", "https://<your-rconfig-server>/mcp", "--header", "Authorization: Bearer YOUR_MCP_TOKEN" ] } }}These are the same settings as the MCP server page, which stays the reference. After the restart, rConfig’s eight tools appear in the chat’s tools menu.
The bridge is a small Node.js program that npx downloads on first run. If your machines can’t fetch packages from npm, install mcp-remote through your usual software channel first.
Custom connector
Only use this route if /mcp is published to the internet, ideally behind a reverse proxy that exposes that path alone and restricts source addresses. See Where the agent runs decides your network design before you do.
- In Claude, open Customize → Connectors and add a custom connector (on Team and Enterprise plans, an Owner adds it under Organization settings → Connectors).
- Enter
https://<your-rconfig-server>/mcpas the server URL. - Choose No sign-in for authentication.
- Under Request headers, add
authorizationwith the valueBearer YOUR_MCP_TOKEN, including the wordBearerand the space.
Add the rConfig Skill
Upload the rConfig Skill zip as a custom Skill in Claude’s settings. It tells Claude how to chain rConfig’s tools, so short questions like “what changed on edge-fw-02?” work without step-by-step prompting.
Things to ask
Claude Desktop suits questions that end in a document someone else will read.
- Change board summary: “Using rConfig, summarise every config change on the Edge group this week for the change board: device, what changed, and the likely reason. Plain English, one paragraph per device.”
- Audit answer: “Is
lon-fw-01compliant in rConfig? For any failing policy, explain the reason rConfig recorded and what the config is missing.” - Handover notes: “Read the running config of
par-wan-03from rConfig and write handover notes for a new engineer: routing, WAN links, management access, anything unusual.”
Related reference
- Connect an AI agent over MCP
- Download the rConfig Skill
- ChatGPT and Claude on the web
- Troubleshooting MCP connections
Frequently asked questions
Can Claude Desktop connect to an rConfig server that isn't on the internet?
Yes, through the local mcp-remote bridge. It runs on your computer and connects to rConfig from there, so it works with internal addresses. A custom connector does not, because it connects from Anthropic's cloud.
Why don't I see Request headers when adding a custom connector?
Request header authentication is a beta feature that isn't available to every organisation yet. Without it, a custom connector has no way to send rConfig's bearer token, so use the local bridge instead.
Is the token in a custom connector shared?
On Team and Enterprise plans an Owner adds the connector for the whole organisation, and a request header is one credential for everyone who uses it. Use a token from a dedicated rConfig user with the narrowest device access that works.