MCP Inspector

Identity for AI Agents - Patrick Riley & Carlos Galan, Auth0

Jan 14, 2026 · 1:22:12

Patrick Riley and Carlos Galan from Auth0 (Okta) present new identity and access management features for AI agents, including Async Auth, Token Vault, and MCP integration. Token Vault securely stores and refreshes upstream resource tokens, enabling agents to access APIs on behalf of users. Async Auth allows agents to request user approval for risky operations, such as placing an order, via out-of-band notifications like push to the Guardian app. They demonstrate a Next.js chatbot that uses Token Vault to read a user's stock portfolio and Async Auth to require explicit consent before executing trades. The MCP server is secured with OAuth 2.0, supporting Dynamic Client Registration (DCR) and fine-grained scopes. The solution bridges user identity, agent identity, and upstream API authorization, ensuring agents can act autonomously but with user-defined boundaries.

Building Protected MCP Servers — Den Delimarsky and Julia Kasper, MCP Steering Committee & Microsoft

Jun 20, 2025 · 20:13

Den Delimarsky and Julia Kasper, Microsoft engineers on the MCP Steering Committee, explain how the new MCP authorization spec simplifies securing remote MCP servers by separating the resource server from the authorization server, eliminating the need for developers to build custom token factories. They argue that developers shouldn't need to be security experts, so the spec offloads token minting and lifecycle management to standard identity providers like Entra ID, Okta, or Auth0. The client now handles the full OAuth 2.0 dance, while the server only validates tokens via a Protected Resource Metadata (PRM) document. A live C# SDK demo shows a server configured with minimal code, and an Azure API Management deployment demonstrates production-ready remote MCP servers with OAuth proxy and consent flows, including integration with VS Code and GitHub Copilot. The session also previews transforming REST APIs into MCP tools via Azure API Management.