Installation Guide¶

This guide covers deploying AgentCube connectors and connecting them to your AI platform.

Prerequisites¶

Before you begin, ensure you have:

• Oracle EPM environment — Essbase 21c and/or Planning Cloud (EPBCS/PBCS) with REST API access
• Container hosting platform — Azure Container Apps, AWS ECS Express Mode, OCI Container Instances, on-premise Docker, or any platform that runs Linux containers
• AI platform account — Claude.ai, Microsoft Copilot Studio, or another MCP-compatible client

For SSO deployments, you will also need:

• Identity provider — Microsoft Entra ID, Okta, Auth0, Keycloak, or any OIDC-compliant provider
• OCI Identity Domain — For Oracle token exchange (free tier is sufficient)

Choose Your Path¶

Quick Start — Basic Auth¶

The fastest way to get AgentCube running. Uses a service account for all Oracle API calls.

Basic Auth Quick Start

Full SSO Setup¶

Per-user authentication through corporate SSO. Users see only the data authorized for them by the underlying data source.

SSO Setup Overview

Security Model¶

AgentCube enforces your existing data source security — it does not introduce a separate authorization layer.

• Row-level security — Users only see data for members they are entitled to in the underlying data source. The AI assistant never receives restricted data.
• Application-level security — Users only see applications they have been granted access to.
• SSO pass-through — The authenticated identity is passed through to the data source. No secondary login or stored credentials.
• No data caching — AgentCube does not cache query results. Every request goes to the data source in real-time with the user's security context.

In Basic Auth mode, all requests use a shared service account. In SSO mode, each user authenticates independently and their data source entitlements are enforced per-session.

Deployment Steps¶