Hosted, in your cloud, or on premises.
Deployment sets the service your team connects to. Choose the location that meets your infrastructure and data residency requirements.
MarcoPolo hosted
Start with the service at mcp.marcopolo.dev. MarcoPolo hosts the runtime; your team authorizes sources and decides which users and applications may access each connection.
Your cloud or on premises
Deploy in AWS, Google Cloud, or Azure, or in an on-premises environment such as VMware or OpenShift. Work with the MarcoPolo team to plan the deployment and obtain its service URL.
For a deployment in your environment, agree who owns infrastructure, upgrades, monitoring, backups, and support as part of the deployment plan.
Connect to the controls you already use.
Plan the path from the caller to the runtime and from the runtime to each source. Review these boundaries with your infrastructure and security teams.
Network and data location
Plan source reachability, region, and private connectivity, including VPC peering or PrivateLink where appropriate. Source data stays in place; query results and files can persist in the workspace and results can be returned to the calling assistant or application.
Enterprise identity
Connect your identity provider for single sign-on. Decide how users and service accounts receive access to MarcoPolo and its connections. Signing in establishes identity; source access still needs authorization.
Source permissions and task policy
Authorize each source using its supported authentication method. The source enforces the permissions of those credentials; MarcoPolo grants and task restrictions constrain how callers use the connection.
Logging and SIEM
Route OpenTelemetry logs and traces into your monitoring and SIEM tools. Agree what evidence to capture and retain, including whether response capture is needed; full tool responses are not traced by default.
Use MarcoPolo from the assistant you work in.
MCP connects your assistant to MarcoPolo’s tools. Requests run under your MarcoPolo identity, using your workspace and the connections available to you.
Add MarcoPolo and sign in
Follow the guide for Claude, ChatGPT, Codex, or Cursor. Use the hosted service or the URL supplied for your deployment. Client setup and administrator requirements vary by assistant.
Make approved connections available
Try a demo connection, or authorize enterprise sources in Agent Console. Connection owners and administrators decide who can use each connection; changing assistants does not expand that access.
Run a task and review the work
Ask the assistant to query an approved source. Inspect the query, results, and activity record, then follow up using the work saved in your workspace.
Choose the identity. Then choose the interface.
Call MarcoPolo through the Python SDK or REST API, or expose its tools to an agent through MCP. The identity determines the workspace and permissions used by the request.
Shared application access
Use a service account when every caller may use the same approved connections. Keep its token on the application backend. Requests share that account’s workspace and audit identity.
Access for each user
Use a dedicated MarcoPolo namespace when connections, workspaces, or audit identity must follow each person. Your backend exchanges the namespace key for short-lived user tokens.
For your own development work, start with a personal API token. The Python SDK is in preview; API tokens are available to Enterprise organizations. A dedicated namespace is provisioned with the MarcoPolo team.
