---
title: MCP Server
description: An MCP Server application in Agent Privilege fronts a backend MCP server so that AI agents get just-in-time, least-privilege access with full session visibility.
component: privilege
page_id: privilege:agent-privilege:configuration/agentic-apps/mcp-server
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/agentic-apps/mcp-server.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
section_ids:
  configure-mcp-server-integration: Configure MCP Server integration
  before-you-begin: Before you begin
  step-1-create-an-mcp-server-application-in-pingone-privilege: "Step 1: Create an MCP Server application in PingOne Privilege"
  step-2-configure-policies-for-mcp-tools-prompts-and-resources: "Step 2: Configure policies for MCP tools, prompts, and resources"
  step-3-establish-connectivity-between-agent-and-gateway: "Step 3: Establish connectivity between agent and gateway"
  result: Result
---

# MCP Server

An MCP Server application in Agent Privilege fronts a backend [Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro) server. MCP clients that connect to the application's **Frontend URL** are routed through the [AI gateway](../ai-gateways.html), which authenticates users through PingOne and enforces PingOne Privilege policies.

This integration provides:

* Tools for standardizing how applications provide context to LLMs.

* Tool, prompt, and resource-level PingOne Privilege policy configuration.

* Full audit of agent tool calls in **Activity > Activity Logs**.

## Configure MCP Server integration

Configuration involves creating an MCP Server application in PingOne Privilege, configuring policies for the application, and establishing connectivity between the agent and an Agent Privilege gateway.

### Before you begin

Ensure you have the following:

* An AI gateway configured in Directory > Gateways. Learn more in [AI gateways](../ai-gateways.html).

* The endpoint and credentials for the backend MCP server.

### Step 1: Create an MCP Server application in PingOne Privilege

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. Click the **Add Application** tab.

3. In the **MCP Server** tile, click **Integrate**.

4. Configure the following fields:

   * **Application Name**: A name for the application, which must be lowercase with no spaces, for example, `mcp-pingone-admin`.

   * **Frontend URL**: The URL that MCP clients use to access the AI gateway, for example, `https://<mcpgw-dns>`.

   * **MCP Server URL**: The actual backend MCP server endpoint, including port and path, for example, `https://mcp-server-internal:8080/mcp`.

   * **Auth Mode**: How PingOne Privilege authenticates to the backend MCP server:

     * **Static Token**: A fixed token that PingOne Privilege sends on every request.

     * **User Token**: The authorization token is sourced automatically from the calling user's [User Vault](../../use-cases/user-vault.html) credential at request time. No token input is required.

     * **OAuth**: PingOne Privilege authenticates to the server with an OAuth flow.

     * **None**: No authentication is sent to the MCP server. Use this only if the server is publicly accessible or secured at the network level.

   * **Headers**: Optional custom HTTP headers to send when connecting to the MCP server.

   * **Mesh Cluster**: Leave this field empty for now. You'll select the mesh cluster after you create the application.

5. Click **Create**.

### Step 2: Configure policies for MCP tools, prompts, and resources

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. In the list, find the **MCP Server** application.

3. Click **(⋮)**, then click **Create Policy**.

4. Select which operations from the MCP Server specification are available to agents.

5. Click **Update Configuration**.

6. Add the users or groups the policy will apply to.

7. Define the users or groups the policy will apply to.

8. Click **Continue**.

9. Configure the policy with the following fields:

   * **Policy Name**

   * **Select Timezone**

   * **Start Date** and **Start Time**

   * **End Date** in hours, days, weeks, months, or custom date.

10. Click **Submit** to save the policy.

### Step 3: Establish connectivity between agent and gateway

1. In the PingOne Privilege admin console, go to **AI Security > Agentic Apps**.

2. On the **Active Applications** tab, find the **MCP Server** application and click **More Info**.

3. On the **Overview** tab's **Resource Information** section, select a configured **AI Gateway** from the list.

4. Copy the **MCP Config** code.

5. Use the code you just copied to connect to the **MCP Server** app through your client. For example, you can paste the code into Claude Desktop.

   **Result:** The associated **MCP Server** app is now accessible through that client.

6. Validate that the MCP Server tools appear in the client and that restricted tools don't appear.

### Result

Users can now get the **MCP Config** for connecting their client to the **MCP Server** app under **Agentic Apps** in the PingOne Privilege user console.