Descope MCP Server: Security Model, Pricing, and Evaluation

This older record retains its original scope. Current buying qualifications above take precedence where terms have changed.

Kingy verdict: Descope MCP Server is one of the more concrete identity-administration MCP products because the security model is documented at the operation level: sessions begin read-only, write requests require explicit approval plus an out-of-band one-time passcode, and elevation expires after 15 minutes. That architecture reduces silent-write risk, but it does not make a broadly connected identity console low risk.

What the server exposes

Descope launched the hosted remote server on June 8, 2026. An MCP-compatible assistant can search Descope documentation, inspect project configuration, query users and tenants, review audit logs, examine access-control objects, and work with authentication flows, connections, keys and agentic-identity configuration. The documented endpoint is remote rather than a package customers install locally. That delivery model simplifies client setup but also makes Descope account authentication, service availability and vendor-side change management part of the operating dependency.

The useful distinction is between documentation work and project administration. docs_search and docs_ask_question provide grounded product help; read buckets expose live project state; write buckets can change users, credentials, flows, roles, tenants and MCP registrations. Teams should inventory which buckets their client can call instead of treating “connected to Descope” as one permission.

Security model and limits

Read tools become available after authentication. For a write, the assistant must identify the operation and arguments, show the target, wait for approval, and trigger a one-time passcode through a channel it does not control. The elevated window then closes automatically after 15 minutes. Sessions are scoped to one Descope company, and administrative MCP events are logged.

This is a meaningful human-control boundary, not proof that every proposed change is safe. A user can still approve a destructive or mis-scoped action. Acceptance testing should cover project selection, tenant boundaries, redaction, audit completeness, credential rotation, revocation, replay resistance, client disconnects and what happens when a multi-step workflow crosses the elevation timeout.

Pricing and availability

The MCP Server is offered with Descope’s identity platform. Descope currently publishes Free at $0, Pro from $249 per month, Growth from $799 per month and Enterprise by quote, with different usage and feature allowances. Public material does not isolate every MCP operation or limit by tier, so confirm entitlement in the console or contract rather than assuming the full write catalog is included in the free plan.

How Kingy would evaluate it

Start with a disposable project and read-only tasks: list roles, summarize an audit window and compare a flow against a documented policy. Then enable one narrowly scoped write, capture the proposed arguments, approve it, verify the resulting audit event and test automatic reversion after the 15-minute window. Repeat with a rejected OTP and a second company to confirm isolation.

Kingy reviewed Descope’s announcement, current MCP documentation, pricing table and Agentic Identity Hub materials. We did not connect a production Descope tenant or validate the control path independently. The strongest reason to trial the server is its inspectable elevation contract; the strongest reason to proceed cautiously is the breadth of identity infrastructure available behind that contract.

Primary sources

• Descope MCP Server announcement and security model
• Descope MCP Server documentation and tool catalog
• Descope pricing
• Agentic Identity Hub 2.5 announcement
• Descope MCP authorization documentation