01 · ABOUT

What Inbound Apps does

Provides identity infrastructure for AI agents and MCP servers, including authorization, scoped access control, consent, token management, and DCR security.

Why teams reach for it: Teams who want Descope to be the OAuth authorization server for their APIs and MCP servers, handling client registration, login and consent.

Worth knowing

It implements OAuth 2.1, with PKCE supported, and CIMD and DCR client registration.

SaaSMCP Server
02 · TECHNICAL SPECIFICATIONS

How Inbound Apps compares

Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."

Oauth Version
OAuth 2.1
Client Registration
CIMD and DCR
Resource Indicators (RFC 8707)
Yes
Protected Resource Metadata (RFC 9728)
Yes
Pkce
Supported
Token Exchange (RFC 8693)
Yes
03 · NEW TO MCP?
Who can connect, and what may they do?

Authorization & identity tools control who — or which AI agent — is allowed to connect, and what they're allowed to do once connected.