Connecting Gemini Enterprise to ActivityInfo

Language: English

Gemini Enterprise reaches ActivityInfo through a custom MCP server connection. Unlike the other assistants in this manual, Gemini Enterprise does not register itself with ActivityInfo, so you register it once yourself and paste the resulting client ID into its settings.

Before you begin

The MCP server has to be enabled for each database you want to work with. See Enabling the MCP server for a database.
Read Using AI assistants with sensitive data before you connect a database that holds personal data.
You need to be an administrator of your Gemini Enterprise team.
You need a way to send an HTTP request, such as curl or Postman, for the registration step.

These are the values you will need:

Setting	Value
MCP server URL	`https://www.activityinfo.org/mcp`
Authorization URL	`https://www.activityinfo.org/oauth/authorize`
Token URL	`https://www.activityinfo.org/oauth/token`
Scopes	`activityinfo.read activityinfo.write`
PKCE	Required

Step 1: Find the callback URL

Gemini Enterprise sends users back to a callback URL after they sign in to ActivityInfo. You have to register that exact URL with ActivityInfo, so find it first.

Sign in to Gemini Enterprise – Business edition.
Click “Settings & help”.
Select your team, then go to “Manage team” > “Connected apps”.
Click “Add MCP Server” and look for the callback URL, sometimes called the redirect URI, in the authentication settings.

If the callback URL only appears after you save the connection, fill in the rest of the form with a placeholder client ID, save, copy the callback URL, and come back to correct the client ID at the end of Step 2.

Step 2: Register Gemini Enterprise with ActivityInfo

Send a registration request to ActivityInfo, with the callback URL from Step 1 as the redirect URI. The request needs no authentication.

curl -X POST https://www.activityinfo.org/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
        "client_name": "Gemini Enterprise",
        "redirect_uris": ["<CALLBACK URL FROM STEP 1>"]
      }'

ActivityInfo replies with a client_id:

{
  "client_id": "sQ8vK2mR7pX4nB9dL6tY3wF1jH5gC0aZ",
  "client_name": "Gemini Enterprise",
  "token_endpoint_auth_method": "none"
}

Keep the client_id. Register once for your organisation, not once per user. For more about this step, see Registering an OAuth application.

ActivityInfo issues no client secret, which is why token_endpoint_auth_method is none. Each sign-in is protected by PKCE instead, which you switch on in the next step.

Step 3: Add the MCP server connection

On the “Connected apps” page, in the “Add MCP Server” panel:

Fill in the MCP information:

Field	Value
Server URL	`https://www.activityinfo.org/mcp`
Name	`ActivityInfo`
Description	`Read and analyse data in ActivityInfo databases`

Choose OAuth 2.0 as the authentication method and fill in:

Field	Value
Authorization URL	`https://www.activityinfo.org/oauth/authorize`
Token URL	`https://www.activityinfo.org/oauth/token`
Client ID	The `client_id` from Step 2
Client secret	ActivityInfo issues none and ignores this field. Where a value is required, enter any placeholder, such as `not-used`
Scopes	`activityinfo.read activityinfo.write`

Switch on PKCE. ActivityInfo requires it, and the sign-in fails without it.
Click “Add”.

Step 4: Enable the connection

A new MCP server connection is disabled until you enable it. Enable the connection so that it becomes visible to your team.

Confirm the connection

Each member of the team signs in to ActivityInfo with their own account the first time they use the connection, and approves it on the “Authorize application” screen. They see only what their own role in ActivityInfo allows.

Ask:

List my ActivityInfo databases.

Troubleshooting

What you see	Cause
`PKCE with code_challenge_method=S256 is required`	PKCE is not switched on for the connection. Switch it on
`redirect_uri does not match a registered URI`	The callback URL registered in Step 2 differs from the one Gemini Enterprise uses. ActivityInfo compares the whole URL exactly, including the port and the path. Register again with the exact value
`invalid_client: unknown client_id`	The client ID is mistyped, or the registration was removed because no user had ever approved it. Register again
The connection is not visible to the team	The connection is still disabled. See Step 4
“The MCP server is not enabled for database …”	Nobody has enabled the setting for that database. See Enabling the MCP server for a database
“Forbidden: this tool modifies data, but the authorization is read-only”	The user granted read access only. They can revoke the authorisation and approve it again, allowing changes

Next item

Reviewing and revoking connected assistants