--- title: "Descope: MCP vendor profile | Agent MCP Directory" description: "Descope: auth provider. Products: MCP Authorization. 9 dated facts, prices, standards and two checks, each sourced, read 5 November 2026." canonical: https://agentmcpdirectory.com/vendors/descope site: "Agent MCP Directory" last_updated: 2026-11-05 section: "Vendors" --- # Descope: MCP vendor profile | Agent MCP Directory > Descope: auth provider. Products: MCP Authorization. 9 dated facts, prices, standards and two checks, each sourced, read 5 November 2026. Source: https://agentmcpdirectory.com/vendors/descope Site: Agent MCP Directory Last reviewed: 2026-11-05 # Descope: MCP vendor profile Descope acts as the authorization server for MCP servers: it publishes discovery metadata, registers clients by CIMD or DCR, runs login and consent, issues tokens and stores downstream credentials in a Connections vault, as documented by the vendor. Descope asks the MCP server to host a /.well-known/oauth-protected-resource document that names Descope as its authorization server (docs.descope.com). ## At a glance | Listed as | Descope (MCP Authorization) | | --- | --- | | Type | Auth providers | | Home | docs.descope.com | | Price | monthly base plus usage | | Read | 5 November 2026 | ## What it does for this layer Descope ships server-side MCP SDKs: @descope/mcp-express middleware with an authenticated /mcp endpoint and per-tool scopes, and the descope-mcp Python SDK with FastMCP integration ([docs.descope.com](https://docs.descope.com/mcp)). Descope Connections stores OAuth tokens, refresh tokens, static API keys and other credentials that MCP tools exchange for at call time, so the MCP client never holds the downstream credential ([docs.descope.com](https://docs.descope.com/mcp)). Descope lists an early-access Descope MCP gateway that routes to tenant-specific or shared MCP servers, and can also be the identity provider for a gateway the customer runs ([docs.descope.com](https://docs.descope.com/mcp)). Descope supports Cross App Access (XAA) for sellers of MCP servers that accept customers' ID-JAG tokens ([docs.descope.com](https://docs.descope.com/mcp)). Descope Access Control Policies define which MCP clients or AI agents may request or use specific MCP server scopes ([docs.descope.com](https://docs.descope.com/mcp)). Descope pricing lists Free Forever with 7,500 monthly active users and 10 tenants, Pro from 249 USD a month and Growth from 799 USD a month ([www.descope.com](https://www.descope.com/pricing)). Descope counts MCP authentication use as monthly active consents, one per unique user who consents to an app, priced separately from MAUs ([www.descope.com](https://www.descope.com/pricing)). Descope's MCP page says Descope "publishes the OAuth discovery metadata, registers MCP clients (CIMD/DCR), runs login and consent, and issues tokens", while the MCP server validates signature, aud and scope ([docs.descope.com](https://docs.descope.com/mcp)). ## Products and plans | Product | What it does | Price | | --- | --- | --- | | MCP Authorization | Managed authorization server, client registration, consent, token issuance and credential vault for MCP servers. | monthly base plus usage; from 0 USD; Free Forever 7,500 MAUs; Pro 249 USD a month (source, as of 5 November 2026) | ## Standards | Standard | Part of it | Status | What the page says | Source | | --- | --- | --- | --- | --- | | MCP | client ID metadata documents | Supports | Descope registers MCP clients by CIMD or DCR. | docs.descope.com | | MCP | dynamic client registration | Supports | Descope registers MCP clients by CIMD or DCR. | docs.descope.com | | MCP | protected resource metadata | Supports | The server hosts /.well-known/oauth-protected-resource naming Descope. | docs.descope.com | ## Checks on its own domain | Check | Domain | Result | Scanned | Method | | --- | --- | --- | --- | --- | | Ora cached score | descope.com | 74 of 100, grade B | 20 October 2026 | how it was taken | | Cloudflare agent-readiness scan | descope.com | 53 of 100, L4 Agent-Integrated; 8 of 15 counted checks passed | 5 November 2026 | how it was taken | ## What it does not do - Descope does not run the MCP server code; token checks happen in the developer's server, through the Descope SDKs or custom code. ## Related on this site Type - [Auth providers](https://agentmcpdirectory.com/vendors/by-type/auth-provider/) Standards - [MCP](https://agentmcpdirectory.com/standards/mcp/) Section - [All vendors](https://agentmcpdirectory.com/vendors/) Edition 4 November 2026 Method [How rows are verified](https://agentmcpdirectory.com/method/) Data [CSV and JSON](https://agentmcpdirectory.com/data/) Markdown [This page as markdown](https://agentmcpdirectory.com/vendors/descope/index.md) ## Sources - [MCP Authorization - Descope Documentation](https://docs.descope.com/mcp), read 5 November 2026 - [Descope pricing](https://www.descope.com/pricing), read 5 November 2026 Last reviewed 5 November 2026