Descope updates Agentic Identity Hub with policy and MCP auth

Descope updated its Agentic Identity Hub to support identity for AI agents and MCP servers, with added controls for agent access and authentication flows. The update matters because it addresses how organizations handle delegated and scoped permissions as agent activity expands beyond interactive use.

Descope framed the changes around the challenge of adopting AI agents using approaches that rely on shared or hard-coded credentials. The company cited findings from GitGuardian and Gravitee that described increased hard-coded secrets in public repositories and that many teams treat agents as identities by sharing API keys rather than handling them independently.

The Agentic Identity Hub is based on ephemeral credentials, delegated access, and OAuth / MCP protocol compliance. Descope said the expanded capabilities include enhanced access policies for granular authorization, support for autonomous agents that authenticate without delegating users, and human-in-the-loop flows using the Client-Initiated Backchannel Authentication (CIBA) flow for step-up authentication tied to time-bound tokens.

In addition, Descope said the hub supports “Standalone” MCP auth and consent without changing existing homegrown or third-party user authentication systems, and it introduced an MCP server that lets developers use AI agents and LLMs to run authentication, management, and analytics operations on Descope projects. “Agentic AI adoption is highlighting the need for a new identity layer,” said Alejandro Leal, Senior Analyst at KuppingerCole. “In the race to deploy AI systems, organizations are employing identity anti-patterns that can’t be governed at scale. Enforcing scoped, delegated access and maintaining identity context across API interactions is critical for secure, sustainable AI growth.”

Forward-looking statements in the press release were limited to: “Today’s newly announced capabilities help even more organizations become agent-ready–whether by securely exposing their product APIs to AI agents, adding MCP auth without changing existing user stores, or bringing autonomous agents out of the ‘fog of war’ with full identity lifecycle management.”

Provided by Globe Newswire on behalf of Descope. Click to read original content.