Descope: MCP vendor profile
Descope acts as the authorization server for MCP servers: it publishes discovery metadata, registers clients by CIMD or DCR, runs login and consent, issues tokens and stores downstream credentials in a Connections vault, as documented by the vendor. Descope asks the MCP server to host a /.well-known/oauth-protected-resource document that names Descope as its authorization server (docs.descope.com).
At a glance
| Listed as | Descope (MCP Authorization) |
|---|---|
| Type | Auth providers |
| Home | docs.descope.com |
| Price | monthly base plus usage |
| Read | 5 November 2026 |
What it does for this layer
Descope ships server-side MCP SDKs: @descope/mcp-express middleware with an authenticated /mcp endpoint and per-tool scopes, and the descope-mcp Python SDK with FastMCP integration (docs.descope.com). Descope Connections stores OAuth tokens, refresh tokens, static API keys and other credentials that MCP tools exchange for at call time, so the MCP client never holds the downstream credential (docs.descope.com). Descope lists an early-access Descope MCP gateway that routes to tenant-specific or shared MCP servers, and can also be the identity provider for a gateway the customer runs (docs.descope.com).
Descope supports Cross App Access (XAA) for sellers of MCP servers that accept customers' ID-JAG tokens (docs.descope.com). Descope Access Control Policies define which MCP clients or AI agents may request or use specific MCP server scopes (docs.descope.com). Descope pricing lists Free Forever with 7,500 monthly active users and 10 tenants, Pro from 249 USD a month and Growth from 799 USD a month (www.descope.com).
Descope counts MCP authentication use as monthly active consents, one per unique user who consents to an app, priced separately from MAUs (www.descope.com). Descope's MCP page says Descope "publishes the OAuth discovery metadata, registers MCP clients (CIMD/DCR), runs login and consent, and issues tokens", while the MCP server validates signature, aud and scope (docs.descope.com).
Products and plans
| Product | What it does | Price |
|---|---|---|
| MCP Authorization | Managed authorization server, client registration, consent, token issuance and credential vault for MCP servers. | monthly base plus usage; from 0 USD; Free Forever 7,500 MAUs; Pro 249 USD a month (source, as of 5 November 2026) |
Standards
| Standard | Part of it | Status | What the page says | Source |
|---|---|---|---|---|
| MCP | client ID metadata documents | Supports | Descope registers MCP clients by CIMD or DCR. | docs.descope.com |
| MCP | dynamic client registration | Supports | Descope registers MCP clients by CIMD or DCR. | docs.descope.com |
| MCP | protected resource metadata | Supports | The server hosts /.well-known/oauth-protected-resource naming Descope. | docs.descope.com |
Checks on its own domain
| Check | Domain | Result | Scanned | Method |
|---|---|---|---|---|
| Ora cached score | descope.com | 74 of 100, grade B | 20 October 2026 | how it was taken |
| Cloudflare agent-readiness scan | descope.com | 53 of 100, L4 Agent-Integrated; 8 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- Descope does not run the MCP server code; token checks happen in the developer's server, through the Descope SDKs or custom code.