Article - CS476014
Enabling MCP Client Access via a Local Reverse Proxy for Windchill SAML Single Sign-On
Modified: 27-Jul-2026
Applies To
- Windchill PDMLink 13.0.2.11
- Windchill PDMLink 13.1.3.0
- Windchill PDMLink 12.1.2.23
Description
- This article describes an approach for a local reverse proxy: a process that performs the SAML login once and then forwards requests to Windchill with the authenticated session attached. A client is configured to send its requests to the proxy on localhost and requires no awareness of SAML.
- This article documents the motivation, the Windchill authentication model, and the key implementation techniques. The primary example is in Python (standard library only); notable differences for a Node.js implementation is described at the end.
-
This article describes the recommended approach for connecting an MCP (Model Context Protocol) client to an SSO-protected Windchill environment when the MCP client itself cannot be modified and can only be configured with a server URL
- When to use this approach: This method is appropriate when the MCP client is one you cannot modify - you can only point it at a server URL. This includes VS Code and Claude Code, as well as any custom or third-party MCP client.
- What It provides: A small process that logs in once and forwards the client's requests to Windchill with the authenticated session attached. The client is pointed at http://localhost:<port> and needs no awareness of SSO.
- Audience: Developers/Operators - it runs as a sidecar next to the client. The most hands-on / developer-focused option.
- Important: PTC does not ship a ready-made reverse proxy implementation for this use case. The article provides illustrative code snippets only; the customer is responsible for building the reverse proxy potentially using the below article's guidance and then distribute/install it internally.
- Depending on the client environment and deployment constraints, refer other approaches in Knowledge Base articles below:
This is a printer-friendly version of Article 476014 and may be out of date. For the latest version click CS476014