This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Descope is a customer identity platform that now also manages identity for AI agents and MCP servers. Its Agentic Identity Hub protects MCP servers with OAuth 2.1, stores the tokens agents need for other services, and applies access policies. Descope also runs its own MCP server for managing a Descope project.
Checked against: Descope's Agentic Identity Hub docs on 28 October 2026. eSEOspace did not test Descope's products.
Key Takeaways
- Descope's Agentic Identity Hub covers MCP servers, agent clients, a credential vault called Connections, policies and agent governance.
- Descope recommends Client ID Metadata Documents (CIMD) for new MCP servers and keeps Dynamic Client Registration (DCR) "primarily for backwards compatibility."
- An Agent Gateway is in early access; Descope can also be the identity provider for a gateway you already run.
- Descope has a Free Forever plan; MCP sign-ins are counted as "MACs" on its pricing page.
- Descope says it is SOC 2 Type 2 and ISO 27001 certified and FedRAMP High Authorized.
At a glance
| Company | Descope |
|---|---|
| What it offers for MCP | Agentic Identity Hub: MCP server auth, Connections, policies, Cross-App Access, gateway (early access); Descope MCP Server |
| Who it's for | Companies exposing MCP servers to customers, and teams governing internal agents |
| Open source? | Hosted service; MCP SDKs for Express and Python |
| Pricing | Free Forever; Pro from $249/mo; Growth from $799/mo (billed annually) |
What Descope offers for MCP
The Agentic Identity Hub docs describe several parts:
- MCP Servers: servers protected with OAuth 2.1, with per-tool scopes and tenant isolation.
- Clients: OAuth client records for agents. They can be pre-registered, or arrive through DCR or CIMD.
- Connections: a credential vault for the OAuth tokens and API keys agents need downstream. Descope says, "A Connection is a credential vault, not a target an agent authenticates into."
- Policies: rules checked when tokens are issued or exchanged.
- Agent Governance: employees request agent access, and admins approve, deny or auto-approve.
- Enterprise-Managed Authorization: support for Cross-App Access (XAA). This is the same idea as the MCP Enterprise-Managed Authorization extension, where a company's identity provider decides access.
Client registration
The registration methods page says: "For new MCP server deployments, Client ID Metadata Documents (CIMD) is the recommended approach." It suggests enabling both CIMD and DCR, with DCR as the fallback. Requested scopes must come from the server's approved list, and redirect URIs can be limited to approved patterns. That matches the spec's move to CIMD.
Descope's MCP SDKs for Express and Python handle the server side. They validate token signature, audience and scope, per the SDK page.
Gateway
The Agent Gateway "is in early access," and you ask Descope Support to enable it. You deploy it in your own infrastructure. Descope says the agent's token is minted only for the gateway, which then exchanges it for a separate token per downstream route. Descope can also act as the identity provider for other gateways, such as Kong AI Gateway, Portkey (now Palo Alto Networks' Prisma AIRS AI Gateway) or agentgateway.
Descope MCP Server
The Descope MCP Server lets an AI agent manage your Descope project: search users, edit flows, read audit logs and more. The US endpoint is https://mcp.descope.com, with an EU endpoint at https://mcp.euc1.descope.com. Descope says sessions can be limited to read-only mode.
Who it's for
Descope fits two groups. The first is software companies that want customers' AI agents to reach their MCP server or API with scoped, consented access. The second is IT teams that want one place to approve agents, store their credentials and log activity.
Pricing
Descope's pricing page lists four plans as of October 2026:
| Plan | Price | MAUs | MACs (MCP and inbound apps) |
|---|---|---|---|
| Free Forever | $0 | 7,500 | 2,000 |
| Pro | From $249/mo, billed annually | 10,000 | 5,000 |
| Growth | From $799/mo, billed annually | 25,000 | 10,000 |
| Enterprise | Custom | Custom | Custom |
A MAC is counted when a unique user consents to any scope for a resource at least once a month. Outbound tokens (Connections) are counted separately as MATKs. The page says Free has no overages; you upgrade to go past its limits.
Security and trust
Descope's security and compliance page says it is SOC 2 Type 2 certified, ISO 27001 certified, FedRAMP High Authorized, CSA STAR Level 2 certified and PCI DSS certified. It says it is GDPR and HIPAA compliant.
For MCP, Descope's use-case page says it can log each agent's identity, the delegating user and the tools and scopes in use, and stream logs to a SIEM. See our MCP audit logging guide for what to capture.
Alternatives
- Auth0 offers Auth for MCP, Token Vault and Cross App Access.
- Aembit offers an MCP Authorization Server and MCP Identity Gateway for workforce agents.
- Scalekit offers MCP Auth and a separate agent tool-calling product.
Next step
Map who needs access to what before you choose. Our MCP security hub and vendor security questionnaire help with that. Then compare other vendors in our MCP companies hub.
Frequently asked questions
What is the Descope Agentic Identity Hub?
Descope calls it a control plane for AI agent identity. It covers protected MCP servers, agent clients, credential storage, access policies, agent governance and Cross-App Access.
Does Descope support CIMD?
Yes. Descope recommends CIMD for new MCP server deployments and keeps DCR mainly for backwards compatibility. It suggests enabling both.
Is the Descope Agent Gateway generally available?
Not as of October 2026. The docs say it is in early access and must be enabled by Descope Support. You can use Descope as the identity provider for another gateway without early access.
Is there a free Descope plan for MCP?
Yes. The Free Forever plan includes 2,000 MACs, which cover MCP authentication, plus 7,500 MAUs. You must upgrade to exceed those limits.
