An MCP server is a server that implements the Model Context Protocol, exposing a defined set of tools or data an AI agent can call. In an identity context, an MCP server is typically treated as a protected resource: it validates that an incoming request carries a token with the required scope before it acts.
Frequently asked questions
How does an MCP server know a request is legitimate?
It validates the access token presented with the request, checking that its scopes and audience match what the server requires.
Is an MCP server the same thing as an AI agent?
No, the agent is the caller; the MCP server is the tool or data source being called, and it enforces authorization on incoming requests.
Was this definition useful?
Feedback goes to the editor who maintains this entry.
.avif)