Introducing the Descope MCP Server (& 100+ Prompt Examples)
Introducing the Descope MCP Server (& 100+ Prompt Examples)
Co-Founder
Table of Contents
- How to connect and get started
- The security model that governs read and write access
- A walkthrough of every tool the server exposes
- Example prompts organized by role and workflow
Hi, Descopers! We are delighted to announce the Descope MCP Server today. This remote MCP server connects your AI assistant to the Descope identity platform. It gives agents the ability to read documentation, inspect your project configuration, manage users and tenants, configure authentication flows, review audit logs, and make changes to your identity infrastructure, all through natural language and from a single session.
The server supports both sides of the authentication lifecycle from a single endpoint. Build-time work (searching documentation, designing flows, configuring project settings) and operate-time work (managing users, tenants, credentials, and audit logs) happen in the same session. The Descope MCP Server allows you to transition from planning and building to deploying and managing without any loss of context.
Connecting to the Descope MCP Server
The Descope MCP Server is hosted by Descope. There is nothing to install or deploy locally apart from the MCP client of your choice. Connection instructions for popular clients can be found on the Descope MCP Server documentation page.
Tool Overview
The Descope MCP Server exposes 23 tools, each named for the identity object or function it operates on. Tools are grouped into read and write variants. To see all the operations and tools, simply ask your agent for the full catalog.
| Tool | Purpose | Access |
|---|---|---|
| list_operations | Discover the full operation catalog; list all operations by bucket, or fetch the input/output schema for a specific operation | Not applicable |
| session | Manage session context: switch projects, check current identity, generate onboarding plans, and elevate to write mode | Not applicable |
| project_read | View project configuration including JWT templates, lists, snapshots, and messaging localization | Read |
| project_write | Update project settings, clone projects, manage JWT templates, lists, Descopers, and messaging localization | Write |
| access_control_read | Query FGA schemas, roles, permissions, ReBAC relations, and run authorization checks and dry-runs | Read |
| access_control_write | Create and update FGA schemas, roles, permissions, and relations; manage backups and resource details | Write |
| agentic_read | View MCP server definitions, clients, and client secrets | Read |
| agentic_write | Create, update, and delete MCP servers and clients; rotate client secrets | Write |
| audits_read | Search audit events and analytics | Read |
| auth_keys_read | View access key details and password settings | Read |
| auth_keys_write | Create, search, and manage access keys; configure password settings; update JWTs; and impersonate users | Write |
| flows_read | View flows, flow templates, themes, flow localization, and widgets | Read |
| flows_write | Import and manage flows, themes, and flow localization; apply project themes | Write |
| tenants_read | View tenants, tenant settings and SSO admin link state | Read |
| tenants_write | Create and manage tenants, tenant settings, default roles and SSO admin links | Write |
| connect_read | View SSO settings, IDP apps, inbound apps, outbound apps, and third-party apps | Read |
| connect_write | Create and manage SSO applications (OIDC, SAML, WS-Fed), inbound/outbound apps, and SSO tenant settings | Write |
| tests_read | Search test users | Read |
| tests_write | Create and delete test users; generate test OTPs, magic links, and enchanted links | Write |
| users_read | View user records, custom attributes, group membership, trusted devices, and auth history | Read |
| users_write | Create, update, and delete users; manage credentials (passwords, passkeys, TOTP), and custom attributes | Write |
| docs_search | Semantic search across Descope documentation and SDK references | Read |
| docs_ask_question | Ask natural-language questions about Descope and get answers grounded in official documentation | Read |
Example Prompts Organized by Role and Workflow
Developers tend to work across the full breadth of the server. A session might start with a documentation query about SDK integration, move into inspecting the project's current flow configuration, shift into creating a new flow and applying project branding, and end with a test user walking through the result.
Learning and Getting Unstuck
docs_search · docs_ask_question
Integration questions are often the first thing a developer brings to the MCP server. The documentation tools return grounded answers from Descope's docs, SDK references, and GitHub examples without touching project data.
- "How do I implement passwordless sign-in with magic links in a Next.js app?"
- "Show me the React SDK example for handling refresh tokens"
- "What's the difference between Flows and the embedded SDK approach? When should I pick which?"
- "Find the docs for Auth0 to Descope migration"
- "How do I validate a Descope JWT in my Go backend?"
To check the status of your session, whether it is elevated, and what project you are currently working on, you can ask for these details specifically or enter “whoami” for a full overview.
FAQs about Descope MCP Server
Can the Descope MCP Server modify my production data?
Not without your explicit consent. Sessions start in read-only mode. Write operations require you to confirm the specific action, then complete an out-of-band verification (OTP) that the agent never sees. Write access is time-bounded (15 minutes) and reverts to read-only automatically.