Hi I have MCP server installed on my server but its open to public right now Is it possible to have descope auth there and we whitelist descope Ip so not one else can connect?

MCP Server Security with Descope Yes, you can secure your MCP server with Descope authentication and use IP whitelisting. Descope provides comprehensive MCP server authorization through OAuth 2.1 flows . Authentication Setup Descope acts as the authorization server for your MCP server . You configure an MCP server in Descope with scopes, client registration methods, and access control policies .

# Example using Descope Python MCP SDK
from descope_mcp import DescopeMCPServer
server = DescopeMCPServer(
    project_id="your-project-id",
    management_key="your-management-key"
)

IP Whitelisting Options For network-level security, Descope provides static IP addresses that you can whitelist . All outbound requests from Descope services originate from a fixed set of static IP addresses, making it straightforward to configure firewalls and access controls . • Static IPs are available on Pro+ tier plans • Required for regulated environments (SOC 2, HIPAA, PCI) • Enables predictable network behavior for firewall configuration Bring Your Own Auth for MCP | Descope Documentation Agentic Identity Control Plane | Descope Documentation Configuring Public Static IPs | Descope Documentation

Is it require to use MCP SDK ? cant we use authentication as descope has for OIDC without hosting anything on our serever?

MCP SDK vs Direct OIDC The MCP SDK is not strictly required. You can implement MCP server authentication using standard OAuth 2.1/OIDC flows that Descope supports . Direct OIDC Implementation Descope acts as the authorization server and issues OAuth tokens with the right scopes and audience for your MCP server . You can handle the OAuth flow manually:

// Standard OAuth 2.1 authorization code flow
const authUrl = `<https://api.descope.com/oauth2/v1/authorize>?
  client_id=your_client_id&
  response_type=code&
  scope=mcp:tools&
  redirect_uri=your_callback`

Why the SDK Helps The Python MCP SDK simplifies integration by handling token exchange, validation, and MCP-specific authorization patterns . It reduces implementation to "five lines of code" with enterprise-grade access policy support . Serverless Option You can configure MCP servers in Descope without hosting additional infrastructure. Descope manages the authorization server functionality, client registration (DCR/CIMD), and token issuance . Your MCP server only needs to validate the tokens Descope issues. Bring Your Own Auth for MCP | Descope Documentation Descope Joins the Agentic AI Foundation (AAIF)

I dont have source code of MCP server I just run it as javar jar file which acts as server. I want to connect MCP with claud connector What should I add in url, client Id and client secret?

Claude Desktop Configuration For your Java JAR MCP server with Claude Desktop, you need these values from your Descope MCP server configuration: Required Configuration Values 1. URL: Your MCP server endpoint (e.g., `http://localhost:8080/mcp`) 2. Client ID: Use Dynamic Client Registration (DCR) - Claude will auto-register 3. Client Secret: Not needed with DCR - Claude handles this automatically Setup Steps 1. In Descope Console, go to Agentic Identity Hub → MCP Servers 2. Enable Dynamic Client Registration (DCR) 3. Add approved redirect URL:

<claude://oauth-callback/*>

4. Your JAR server must host OAuth metadata at:

<server-url>/.well-known/oauth-protected-metadata

Required Metadata JSON Your JAR server needs to serve this at `/.well-known/oauth-protected-metadata`:

{
  "authorization_servers": [
    "<https://api.descope.com/v1/apps/agentic/YOUR_PROJECT_ID/YOUR_MCP_SERVER_ID>"
  ],
  "bearer_methods_supported": [
    "header"
  ],
  "resource": "<http://localhost:8080/mcp>",
  "scopes_supported": [
    "your_scopes_here"
  ]
}

The authorization server URL comes from your Descope MCP server's Usage Samples section . MCP Server Settings | Descope Documentation Calendar MCP Server (w/ SSO) Example | Descope Documentation Python MCP SDK | Descope Documentation Managing MCP Servers | Descope Documentation

@Rahul Rijhwani @Eliya Sadan can you help here ?

Hi @Dhaval Dalvadi Since you're running a Java JAR file and don't have access to the source code, you won't be able to integrate the Descope MCP SDK directly into the server. But there are two solid options to secure it: Option 1: Golf.dev Gateway (Recommended — No Code Changes Needed) Golf.dev is an MCP-aware firewall/gateway that sits in front of MCP servers — including ones you don't control. It validates Descope-issued tokens, reads roles/scopes, and enforces access policies before requests reach your JAR. Steps: 1. Configure Descope as the identity provider in Golf.dev using your Project ID, Issuer URL, and API Identifiers 2. Point Golf.dev Gateway in front of your MCP server 3. Bind your JAR to localhost so it's only reachable through the gateway Docs: https://docs.descope.com/mcp/gateways/golf-dev Option 2: Auth Proxy with Descope MCP Express SDK You can build a lightweight Express.js proxy that sits between clients and your JAR. The proxy validates Descope tokens before forwarding requests. It's essentially 3 lines of auth code: import { descopeMcpAuthRouter, descopeMcpBearerAuth } from "@descope/mcp-express"; app.use(descopeMcpAuthRouter()); app.use(["/mcp"], descopeMcpBearerAuth()); Tutorial: https://www.descope.com/blog/post/auth-remote-mcp Regarding IP Whitelisting: Instead of whitelisting specific IPs, the better approach is to bind your JAR to localhost only and expose the proxy/gateway publicly. That way the JAR is never directly reachable from the internet. Regarding Claude Connector setup: You don't need to modify the JAR. Instead: Create an MCP Server in Descope console under Agentic Identity Hub → MCP Servers Enable DCR (Dynamic Client Registration) — Claude Desktop will auto-register as an OAuth client • Your Discovery URL and Issuer URL will be in the Usage Samples section of the MCP Server settings • Host the OAuth Protected Metadata Resource JSON at <your-server-url>/.well-known/oauth-protected-metadata Docs: https://docs.descope.com/agentic-identity-hub/mcp-servers

@Rahul Rijhwani I would like to go with auth proxy I have MCP server with SSE how can I use it as there is no step written in provided doc it has note that provided setup will not work for SSE

Hi @Dhaval Dalvadi The auth proxy setup from the blog is HTTP-only and won't work for SSE as-is. For your SSE-based MCP server, here's what you can do: Build a thin Express app that acts as an auth layer in front of your JAR using

@descope/mcp-express

. This SDK has proven SSE support. Your Express app would: 1. Use

descopeMcpAuthRouter()

to handle OAuth metadata/discovery 2. Use

descopeMcpBearerAuth()

on the

/sse

and

/message

endpoints 3. Proxy authorized requests through to your JAR server running on localhost So the flow becomes: Client (Claude) → Express auth layer (validates Descope tokens) → Your JAR MCP server (localhost) The Fly.io deployment guide has a working end-to-end example of this exact pattern with SSE + Descope auth: https://www.descope.com/blog/post/mcp-flyio This way your JAR stays untouched, and only authenticated requests get through.

@Rahul Rijhwani I tried but problem is Claude never redirected for login attaching the code sample I am using right now import "dotenv/config"; import express from "express"; import httpProxy from "http-proxy"; import { authorizationHandler, descopeMcpAuthRouter, descopeMcpBearerAuth, DescopeMcpProvider, } from "@descope/mcp-express"; const app = express(); const descopeProvider = new DescopeMcpProvider({ projectId: process.env.DESCOPE_PROJECT_ID, managementKey: process.env.DESCOPE_MANAGEMENT_KEY, serverUrl: SERVER_URL, dynamicClientRegistrationOptions: { authPageUrl:

<https://api.descope.com/login/${process.env>
            .DESCOPE_PROJECT_ID}?flow=inbound-apps-user-consent

, } }); // Create a proxy server const proxy = httpProxy.createProxyServer({ target: "http://localhost:8000", // your backend MCP/ThingsBoard changeOrigin: true, ws: true, // support WebSocket and SSE pathRewrite: (path, req) => { return path } }); // Handle proxy errors proxy.on("error", (err, req, res) => { console.error("Proxy error:", err.message); try { res.writeHead?.(500, { "Content-Type": "text/plain" }); res.end?.("Proxy error"); } catch (e) { } }); app.use(descopeMcpAuthRouter(undefined, descopeProvider)); const descopeAuthBearer = descopeMcpBearerAuth(descopeProvider); app.use(["/", "/mcp/message"], (req, res, next) => { descopeAuthBearer(req, res, (err) => { if (err) return next(err); proxy.web(req, res); }); }); // Proxy WebSocket / SSE upgrade requests const server = app.listen(8002, () => { console.log("Proxy running on http://localhost:8002"); });

@Atharva Joshi can you follow up here

yes

@Atharva Joshi It didn't worked. and root is / not SSE If I remove descopeAuthBearer and descopeMcpAuthRouter it works fine.