Liferay as an MCP server

Understand the boundary

Model Context Protocol allows a compatible AI client to discover and call tools exposed by a server. Liferay’s MCP server is an instance-level capability in DXP. The 2026.Q3 documentation lists it as a release feature gated by LPD-63311 and instance configuration. The client acts with an effective Liferay user’s permissions. Inventory the tools and the identities that can invoke them before enabling the endpoint.

Test a scoped connection

1. Use a disposable virtual instance with sample records and limited test identities. Verify the feature flags, including the separate flag documented for OAuth metadata discovery if the client needs it.
2. Enable the instance’s MCP server and use the documented Streamable HTTP configuration for /o/mcp. Verify the exact resource URI, including any application context path.
3. Configure the supported authentication method. For OAuth, request a token whose audience includes the MCP resource URI. A bearer token that works against a REST endpoint may have a different audience.
4. Inspect the exposed tools and call a permitted read. Attempt a protected read with the same identity and verify enforcement. Repeat after changing the role.
5. Decide which writes are allowed, when a person should approve them, and how calls will be audited. Disable the instance setting when the evaluation ends.

Diagnose discovery and authorization

Check instance settings and the feature flag for an unavailable endpoint. For a 401, review the identity, token expiry, resource audience, and discovery metadata. For unexpected tool results, reproduce with a restricted identity and check resource permissions. Record method names and outcomes without putting credentials or sensitive result content in logs.

Official references

• Using Liferay as an MCP server
• DXP 2026.Q3 release notes