Earlier version last updated: 2026-07-23
Earlier version last verified: 2026-07-23
Documentation checked October 4, 2026 (UTC): This guide uses public official sources. We did not connect a Descope account, inspect project data, or perform an identity operation for this check.
TL;DR: The Descope MCP Server lets authenticated AI assistants inspect Descope projects and perform identity operations. Sessions begin read-only; writes require explicit, time-bounded elevation.
What launched?
Descope announced its hosted management MCP server on June 8, 2026. Its current documentation lists client-specific connections, including Cursor, VS Code, Claude, Codex, and ChatGPT. Check your client’s current plan and workspace policy before connecting. The launch post and current MCP documentation are the primary sources for this guide.
Identity changes can affect users, tenants, flows, keys, and production sign-in. Descope’s read-first session model separates inspection from changes and makes write elevation an explicit step rather than the default.
What is Descope MCP Server?
The server can inspect users, tenants, flows, access control, audit logs, keys, and other project configuration. It also exposes management operations after an authenticated session is explicitly elevated for a limited period.
This guide covers the hosted management server. Descope’s separate February 18 Docs MCP announcement describes a read-only knowledge service at https://docs-mcp.descope.com/mcp, without project-management access. The original GitHub link below redirects to a local descope-mcp-server-stdio sample requiring a Project ID and Management Key, with stdio/SSE instructions. The hosted server’s human-elevation safeguards should not be assumed to apply to that sample.
Key capabilities and questions
- Documentation:
docs_searchanddocs_ask_questionretrieve Descope product knowledge. - Project inspection: read tool groups cover users, tenants, flows, access control, audits, auth keys, and agentic configuration. Ask for the operation catalog before assuming a particular action exists.
- Session scope: select the intended project within the authenticated company and use the documented endpoint for its region.
- Read access:
agentic_readincludes client-secret retrieval; a read-only session can still disclose sensitive data. - Write access: the vendor documents human approval and out-of-band OTP elevation, with a 15-minute window that closes automatically.
Real use cases
- Search official Descope documentation from an AI assistant
- Inspect auth flows, tenants, users, and audit logs without leaving an IDE or chat interface
- Generate onboarding plans for app auth configurations
- Create or modify identity project objects after explicit human-approved write elevation
- Review agentic identity and MCP server configuration from one session
What teams should review
For identity teams: begin with read-only tasks such as checking flows, tenants, access-control configuration, and audit logs. Treat generated onboarding plans as drafts that still require review against the application architecture.
For security teams: confirm the selected company and project, the connecting account’s access, and which operations it may perform. Descope’s company settings documentation describes project-specific and custom Descoper roles; verify how the intended role applies to your MCP session rather than assuming every account has the same access. The launch post documents explicit approval of the operation and target, an out-of-band human OTP, and a 15-minute write window that closes automatically. These are vendor-described controls, not a security test performed for this guide.
Pricing and free plan
Pricing: Descope platform usage is governed by the selected plan. No separate hosted MCP Server price was identified in the public pricing page reviewed for this documentation check. Paid plans can incur usage-based overages; confirm MCP entitlements, limits, and account billing with Descope before purchase. AI client or model charges are separate considerations.
Free plan: Descope publishes a Free Forever platform plan. Verify that the MCP operations required by your project are included before treating that as a complete no-cost deployment.
How to try it
Follow the current client-specific connection instructions and use the endpoint for your deployment: mcp.descope.com for US, or https://mcp.euc1.descope.com for EU. Private-cloud deployments require Descope Support to enable access. Authenticate and select the intended project. Sessions are scoped to one company; switching companies requires a separate connection and reauthentication. Keep discovery read-only and elevate only for a specific reviewed change. No client connection or elevation was tested here.
Comparison snapshot
| Question | Documentation summary |
|---|---|
| Primary job | Hosted Descope project inspection and identity operations, with read-first sessions and explicit time-bounded write elevation. |
| Best fit | Teams managing Descope users, tenants, auth configuration, and identity operations. |
| Pricing status | No separate hosted MCP price identified in the reviewed public pricing page; verify plan entitlements, usage limits, and billing. |
| Free plan | Descope offers a platform Free plan; verify MCP entitlements |
| Access | Follow client-specific instructions, authenticate, and select the company/project. Use mcp.descope.com for US or the documented EU endpoint; private cloud requires support enablement. |
| Main alternatives | WorkOS AuthKit and agent identity; Auth0 MCP Server and Actions; Okta/Auth0 APIs with custom wrappers; Microsoft Entra Agent ID; a custom OAuth/MCP gateway architecture. |
Alternatives
Compare Descope with identity-management APIs or agent-identity products on read/write separation, auditability, project scoping, supported operations, and the cost of the underlying identity platform.
These options address different jobs. WorkOS and Entra agent identities govern agents acting in applications; an identity-management MCP server exposes administrative tools to an assistant. Custom API wrappers and gateways require engineering and security review. None of the options below was connected or tested for this guide.
- WorkOS AuthKit, MCP authorization, and Agent Auth. Agent Auth is documented for your own first-party agents and must be enabled for the environment.
- Auth0 MCP Server for tenant-management tasks, including deploying Actions. This is an official MCP option, alongside any custom tooling you build.
- Okta and Auth0 management APIs with custom AI wrappers. Design the wrapper’s authentication, allowed operations, approvals, and audit handling.
- Microsoft Entra Agent ID for agents using Entra identities and permissions. Review tenant consent and integration requirements; this is not a Descope project-management replacement by itself.
- A custom OAuth authorization server and MCP gateway, designed against the MCP authorization specification. This is an architecture proposal, not a ready-made service tested here.
Risks and unknowns
Elevated access can change production identity infrastructure. A reviewer should verify the selected project, requested operation, affected users or tenants, and audit record before approving a write. Read-only sessions can still expose sensitive data: the documented agentic_read tool includes client-secret retrieval. Review what the AI client sends to its model provider. The launch post says elevation ends after 15 minutes and does not survive disconnection; recheck session state before continuing. Plan-specific MCP limits still need confirmation.
Should you try it?
Test the server if your team already uses Descope and wants project inspection inside an AI client. Start with audit and configuration queries, verify every answer in the Descope console, and defer write elevation until the read-only workflow is reliable.
FAQ
What does Descope MCP Server do?
It exposes hosted Descope project inspection, documentation tools, and identity-management operations. Sessions start read-only; writes require explicit, time-bounded elevation.
Is Descope MCP Server free?
No separate hosted MCP Server price was identified in the reviewed public pricing page. Descope plan usage, MCP entitlements, and any AI client or model charges still need to be checked.
Who is Descope MCP Server for?
Developers and identity teams that need Descope project inspection or reviewed identity operations inside a compatible AI client.
What are alternatives to Descope MCP Server?
WorkOS AuthKit and Agent Auth, Auth0 MCP Server and Actions, custom Okta/Auth0 API wrappers, Microsoft Entra Agent ID, or a custom OAuth/MCP gateway. Compare the different purposes and access boundaries in the Alternatives section.
Official links
Related Kingy AI links
The Kingy Brief
Get The Kingy Brief.
AI changes, original tests and one practical thing to try. Fridays at 09:00 Vancouver time.
Free · Double opt-in · Unsubscribe anytime
Sign up for The Kingy Brief on Beehiiv.
Signup help and newsletter schedule
Signup form provided by Beehiiv. After submitting, check your inbox for "Confirm your subscription to The Kingy Brief" and open its confirmation link. Check Spam or Promotions if you cannot find it.
Fridays at 09:00 Vancouver time: source-checked AI changes, original tests and one practical thing to try. We skip a week when there is not enough verified material. Free. Unsubscribe anytime.