PingOne Privilege

MCP Server

An MCP Server application in Agent Privilege fronts a backend Model Context Protocol (MCP) server. MCP clients that connect to the application’s Frontend URL are routed through the AI gateway, which authenticates users through PingOne and enforces PingOne Privilege policies.

This integration provides:

  • Tools for standardizing how applications provide context to LLMs.

  • Tool, prompt, and resource-level PingOne Privilege policy configuration.

  • Full audit of agent tool calls in Activity > Activity Logs.

Configure MCP Server integration

Configuration involves creating an MCP Server application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

Before you begin

Ensure you have the following:

  • An AI gateway configured in Directory > Gateways. Learn more in AI gateways.

  • The endpoint and credentials for the backend MCP server.

Step 1: Create an MCP Server application in PingOne Privilege

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. Click the Add Application tab.

  3. In the MCP Server tile, click Integrate.

  4. Configure the following fields:

    • Application Name: A name for the application, which must be lowercase with no spaces, for example, mcp-pingone-admin.

    • Frontend URL: The URL that MCP clients use to access the AI gateway, for example, https://<mcpgw-dns>.

    • MCP Server URL: The actual backend MCP server endpoint, including port and path, for example, https://mcp-server-internal:8080/mcp.

    • Auth Mode: How PingOne Privilege authenticates to the backend MCP server:

      • Static Token: A fixed token that PingOne Privilege sends on every request.

      • User Token: The authorization token is sourced automatically from the calling user’s User Vault credential at request time. No token input is required.

      • OAuth: PingOne Privilege authenticates to the server with an OAuth flow.

      • None: No authentication is sent to the MCP server. Use this only if the server is publicly accessible or secured at the network level.

    • Headers: Optional custom HTTP headers to send when connecting to the MCP server.

    • Mesh Cluster: Leave this field empty for now. You’ll select the mesh cluster after you create the application.

  5. Click Create.

Step 2: Configure policies for MCP tools, prompts, and resources

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. In the list, find the MCP Server application.

  3. Click (⋮), then click Create Policy.

  4. Select which operations from the MCP Server specification are available to agents.

  5. Click Update Configuration.

  6. Add the users or groups the policy will apply to.

  7. Define the users or groups the policy will apply to.

  8. Click Continue.

  9. Configure the policy with the following fields:

    • Policy Name

    • Select Timezone

    • Start Date and Start Time

    • End Date in hours, days, weeks, months, or custom date.

  10. Click Submit to save the policy.

Step 3: Establish connectivity between agent and gateway

  1. In the PingOne Privilege admin console, go to AI Security > Agentic Apps.

  2. On the Active Applications tab, find the MCP Server application and click More Info.

  3. On the Overview tab’s Resource Information section, select a configured AI Gateway from the list.

  4. Copy the MCP Config code.

  5. Use the code you just copied to connect to the MCP Server app through your client. For example, you can paste the code into Claude Desktop.

    Result: The associated MCP Server app is now accessible through that client.

  6. Validate that the MCP Server tools appear in the client and that restricted tools don’t appear.

Result

Users can now get the MCP Config for connecting their client to the MCP Server app under Agentic Apps in the PingOne Privilege user console.