Descope MCP Server – Identity Project Management
The Descope MCP Server is a hosted remote MCP server for working with Descope projects through an AI assistant. It provides authenticated access to project management tasks such as users, tenants, flows, access control, connections, audit logs, and documentation search while keeping write actions behind an explicit elevation flow.
Overview
The Descope MCP Server is Descope's hosted Model Context Protocol endpoint for connecting MCP-compatible assistants to Descope product knowledge and project management workflows. It is intended for developers, identity administrators, and security teams who want to inspect or manage Descope configuration without leaving tools such as Cursor, VS Code, Claude Desktop, Claude Code, Codex, Open Code, Windsurf, or ChatGPT.
Once connected, the server discovers the Descope projects available to the signed-in user and prompts the user to select the active project. The active project can be changed later from the assistant conversation.
What the MCP server enables
The server exposes Descope Management API coverage through natural-language interaction. Documented use cases include searching users, listing tenants, inspecting flows, reviewing access control configuration, checking connections, viewing audit logs, and working with auth keys. It also includes documentation tools for Descope product knowledge:
docs_searchperforms semantic search over Descope documentation and SDK references.docs_ask_questionanswers grounded questions about Descope concepts, setup, SDKs, APIs, and troubleshooting.
Sessions start in read-only mode. Descope documents that search, listing, inspection, and audit queries are available immediately, while write operations require explicit session elevation.
When to use it
Use this MCP server when an AI assistant needs live Descope context for identity operations or implementation support. Practical workflows include asking which SSO connections are configured for a tenant, finding users that have not logged in recently, reviewing configured flows, checking access keys and expiration, investigating recent login failures, or asking how to validate Descope JWTs in a specific framework.
It is also useful for implementation work where project state and documentation context are both needed, such as mapping SSO groups to roles, reviewing fine-grained authorization schema details, or troubleshooting flow and CORS configuration.
Connection and authentication
Descope provides the server as a hosted remote MCP endpoint at https://mcp.descope.com. Supported clients configure it as an HTTP/remote MCP server. Authentication is handled interactively: the user signs in with a Descope account when the MCP client prompts for authorization. No static API key should be embedded in this YAML.
Key considerations
Write operations require explicit elevation and the elevated write window is time-bounded. This protects Descope projects by preventing an assistant from making changes unless the user grants that ability for the session. Available actions are also limited by the authenticated user's Descope project access and permissions. For troubleshooting questions, Descope recommends being specific, including framework and environment context, and pasting exact errors where relevant.
Supported Transports
streamable_http
URL: https://mcp.descope.com
Frequently Asked Questions
- When should an AI agent use the Descope MCP Server?
- Use it when an assistant needs authenticated access to a Descope project or Descope documentation. Typical tasks include reviewing users, tenants, flows, access control settings, connections, audit logs, auth keys, and answering implementation questions from Descope docs.
- What does the Descope MCP Server add to an AI agent's capabilities?
- It adds live, permissioned Descope project context plus documentation Q&A. The assistant can inspect project state, search documentation with docs_search, and ask grounded Descope product questions with docs_ask_question instead of relying only on model training data.
- What can the AI agent access or manage through this server?
- Descope documents coverage for the Management API, including users, tenants, flows, access control, connections, audit logs, auth keys, and related project configuration. Write operations are not available by default and require explicit session elevation.
- How is authentication configured for the Descope MCP Server?
- Clients connect to the hosted endpoint at https://mcp.descope.com and the user signs in with their Descope account when prompted. The server then discovers projects available to that user. This YAML does not include API keys because the documented flow is interactive account authentication.
- Which transport should be used for the Descope MCP Server?
- Use the hosted HTTP remote MCP endpoint at https://mcp.descope.com. Descope documents client setup for Cursor, VS Code, Claude Desktop, Claude Code, Codex, Open Code, Windsurf, and ChatGPT using that remote endpoint rather than a local stdio command.