Skip to main content
AI Data Engine

Manage data collections for AI Data Engine governed AI access

Contributors netapp-dbagwell
PDFs

A collection is a logical container for data sources that you make searchable to AI clients through the Model Context Protocol (MCP) server for AI Data Engine (AIDE). Create collections and enable them for AI access so that connected AI clients can search them.

Before you begin

  • You must have the AI Data Engine administrator role.

  • You have set up Microsoft Entra ID as an identity provider in AI Data Engine, and its connection status is Connected. Refer to Set up an identity provider.

  • You have created a custom data collection or are using a default collection that includes only the data that AI clients need to search. Refer to Create a data collection.

About data collections

A collection is a logical container for one or more data sources. AI Data Engine provides a default collection named All files that includes every system and volume that AI Data Engine has scanned.

Caution Before you grant a scope access to a collection, confirm that everyone who has that scope is allowed to search the metadata for every file in the collection. If you grant a scope access to All files, everyone who has that scope can search the metadata for all scanned data.

To create a collection, refer to Create a data collection. To change a collection, an identity provider, or the MCP server settings later, refer to Maintain your MCP setup.

Create a data collection

Create a data collection to define the data resources that AI clients can search through the MCP server.

Steps

  1. In NetApp Console, go to AI data hub > AI Data Engine.

  2. Select Configuration, then select MCP collections.

  3. Select Create collection.

  4. In Name, enter a unique name for the collection.

  5. Optional: In Description, enter a description to help your team understand the collection's purpose. The description can contain up to 512 characters.

  6. Use the Systems and Protocols filters to narrow the list of data resources.

  7. Select the checkbox next to each data resource that you want to include in the collection.

    The Scan status column shows whether each data resource is Completed, Re-scanning, or in Error. S3 and structured data resources can't be added to a collection.

    The Selected rows summary displays the number of selected resources, their scanned capacity, and their scanned file count. To clear the selection and start again, select Reset.

  8. Select Create MCP collection.

A confirmation message appears, and the new collection is added to the Collections list with a status of Ready to configure. Creating the collection doesn't complete its MCP connection configuration.

The Collections list shows each collection's name, description, number of volumes, scanned capacity, scanned file count, owner, and status. The owner is System for collections that AI Data Engine provides and User for collections that you create.

After you create a collection, configure it for MCP.

Configure a collection for MCP

Select the identity providers and user scopes for an MCP collection, and then obtain the connection details for your AI client.

Important In a power-user session, search isn't filtered by file-level permissions. Users with access to the collection can search every file in it. Include only files that all users assigned to the collection's scopes are allowed to see. Grant a scope access to All files only if everyone with that scope is allowed to search all scanned data.
Before you begin
Steps

  1. In NetApp Console, go to AI data hub > AI Data Engine > Configuration > MCP collections.

  2. Locate the collection that you want to configure, open its Actions menu, and select Configure for MCP.

  3. In the Select identity providers step, select one or more identity providers to authenticate and authorize access to the collection.

    Note If the identity provider that you need isn't listed, add it under Identity providers before you continue. If administrator access is required, ask your administrator to connect the identity provider.

  4. For each selected identity provider, use User scopes to include to specify the scopes:

    1. To include all user scopes, leave All user scopes selected.

    2. To include specific scopes, open the dropdown, select the scopes, and select Add scopes.

      power_users is the only scope in the dropdown, and selecting it gives the same result as All user scopes. The scope name must match the scope that you defined in Microsoft Entra ID.

  5. Select Generate MCP code snippet.

  6. In the Generate MCP code snippet step, copy the connection details that your AI client requires:

    • To use the endpoint directly, select the copy icon next to MCP server URL.

    • To use a client-specific configuration snippet, select the Claude tab for Claude Desktop or the Cursor tab for Cursor under Code snippets, and then select the copy icon. For Claude Code and OpenCode, use the MCP server URL.

      Before you share a snippet, confirm that the host is your AIDE cluster host name and not a cluster or service IP address, and that the URL ends in /mcp/tools and includes the collection_id of this collection. The scope must be https://<host>/mcp/tools/power_users, and the client ID must be the Application (client) ID of your AI Data Engine application in Entra ID.

      Note If the MCP hostname not setup warning appears, select MCP settings to configure the AIDE cluster host name. Refer to Review MCP server settings and Prepare the MCP host. Securing the MCP server with HTTPS requires an SSL/TLS certificate, which the ingress script sets up.

  7. Optional: To change the identity providers or user scopes, select Go back, and then generate the snippet again.

  8. Select Close.

Result

You have the MCP server URL or a client-specific configuration snippet for the selected identity providers and user scopes. Use these details to connect your AI client and validate access to the collection. Make sure that the redirect URI for your AI client is registered in the AI Data Engine application in Entra ID. Use the application's Application (client) ID as the client ID. Refer to Add redirect URIs for your AI clients.

Note Generating connection details doesn't connect or validate your AI client. Complete those tasks in the AI client.

A collection isn't available to AI clients until you select identity providers and user scopes. After you complete this task, the collection has a status of Enabled.

Users whose tokens carry a granted scope can discover and search the collection. Users without a matching scope can't discover, search, or work with the collection.

Disable AI access for a collection

Disable AI access for a collection when AI clients no longer need to search it. When you configure a collection for MCP, AI access is enabled automatically.

Steps

  1. In NetApp Console, go to AI data hub > AI Data Engine > Configuration > MCP collections.

  2. Open the collection's Actions menu and select Disable.

AI clients that use the disabled collection lose access to it after the change applies. Your identity provider and user scope selections are kept. AI clients also can't reach any collection while the connection to MCP is disabled. To block requests to all collections at once, refer to Enable or disable the connection to MCP.