OAuth 2.1 authorization
Authorization code with PKCE for interactive clients and client credentials for headless agents, issued from your environment's OIDC issuer.
Model Context Protocol
Put an identity layer in front of every MCP server your agents connect to. Register the server, front it with OAuth, scope what each client may call, and keep a record of every tool invocation.
Server registry
MCP servers are first-class objects in the console, scoped to an environment so staging connections never resolve in production.
Capture the server URL or launch command, its description, and whether authentication is required before any client can use it.
Attach an OIDC client to a server so the tokens it accepts are issued and revoked through your identity provider.
Development, staging, and production each carry their own server list, clients, and scopes.
Disable a server or its client once and every agent that depended on it loses access immediately.
Testing and audit
Debug the handshake before you ship, and retain an audit record of what agents did once you have.
Connect to a registered server from the console, run the OAuth flow, and call tools interactively to confirm the wiring.
Inspect discovery, token exchange, and authorization responses step by step when a client fails to connect.
Audit entries distinguish an action taken in the console from one taken by an agent over MCP.
MCP activity lands in the same audit log you forward to Datadog, Splunk, Sumo Logic, Sysdig, or a signed webhook.
Add your MCP server to an environment and declare the scopes it exposes.
Bind an OIDC client so clients authenticate before any tool call is served.
Test the flow in the playground, then audit and stream every call in production.
Register a server, issue scoped credentials, and keep every tool call attributable from one control plane.