PingOne Privilege

MCP Aggregate

MCP Aggregate gives AI agents a single, governed entry point to multiple backend MCP servers through one application in PingOne Privilege. It simplifies integration and administration while preserving policy enforcement at the individual server level, so organizations can control which agents can discover and use specific tools, prompts, and resources across a group of MCP servers.

This integration provides:

  • Tools for working with several MCP servers as a single endpoint.

  • Tool, prompt, and resource-level PingOne Privilege policy configuration.

  • Full audit of agent tool calls in Activity > Activity Logs.

Configure an MCP Aggregate integration

Configuration involves creating an MCP Aggregate application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

Before you begin

Ensure you have the following:

  • An AI gateway configured in your PingOne Privilege admin console under Directory > Gateways. Learn more in AI gateways.

  • The endpoint and credentials for each backend MCP server you want to aggregate.

  • Previously created Agentic Apps for the MCP Servers which the Aggregate will represent.

Step 1: Create an MCP Aggregate application in PingOne Privilege

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. Click the Add Application tab and select the MCP Aggregate tile.

  3. Enter a Name for the aggregate application.

  4. Select one or more MCP Servers to aggregate.

  5. Click Create.

Step 2: Configure policies for the MCP Aggregate

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. In the list, find the MCP Aggregate application.

  3. Click (⋮), then click Create Policy.

  4. Select which operations from the MCP Aggregate specification are available to agents.

  5. Click Update Configuration.

  6. Add the users or groups the policy will apply to.

  7. Define the users or groups the policy will apply to.

  8. Click Continue.

  9. Configure the policy with the following fields:

    • Policy Name

    • Select Timezone

    • Start Date and Start Time

    • End Date in hours, days, weeks, months, or custom date.

  10. Click Submit to save the policy.

Step 3: Establish connectivity between agent and gateway

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. On the Active Applications tab, find the MCP Aggregate application and click More Info.

  3. On the Overview tab’s Resource Information section, select a configured AI Gateway from the list.

  4. Copy the MCP Config code.

  5. Use the code you just copied to connect to the MCP Aggregate app through your client. For example, you can paste the code into Claude Desktop.

    Result: The associated MCP Aggregate app is now accessible through that client.

  6. Validate that the MCP Aggregate tools appear in the client and that restricted tools don’t appear.

Result

Users can now get the MCP Config for connecting their client to the MCP Aggregate app under Agentic Apps in the PingOne Privilege user console.