Claude and ChatGPT access to MCP identity tools changes governance

At a glance

What this is: Descope's MCP Server is now available in Claude and ChatGPT, giving AI assistants native access to 23 identity tools across read and write operations.

Why it matters: This matters because AI-mediated access to identity infrastructure creates a governance problem that spans NHI, autonomous behaviour, and human approval boundaries in one control surface.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

👉 Read Descope's post on Claude and ChatGPT access to its MCP Server

Context

MCP is the control layer that lets an AI agent call tools and data sources, so the real issue is not the connector itself but how identity and privilege are exposed to that runtime. In this case, the primary governance question is whether identity administration can safely be mediated by assistants that can read, write, and escalate across projects, tenants, and auth flows.

The Descope MCP Server expands that problem into mainstream agent workflows because it is now exposed through Claude and ChatGPT. That means the boundary between conversation and administrative action becomes thinner, and identity teams have to decide which actions can be delegated, which require escalation, and which should remain outside agent reach altogether.

Key questions

Q: How should security teams govern AI assistants that can make infrastructure changes?

A: Treat the assistant as a privileged non-human identity with narrowly scoped write permissions, explicit ownership, and mandatory approval for every state-changing action. The approval step must be enforced in the execution path, not just described in policy. Teams should also log the full request, proposed plan, and resulting artefacts for auditability.

Q: Why do MCP servers create new IAM and NHI governance risks?

A: MCP servers expose tools in a way that can bypass the access assumptions many teams built for human-operated applications. They make protocol-level invocation, delegated access, and client registration part of the trust boundary. That creates risk when permissions are broad, identities are weakly scoped, or lifecycle ownership is unclear.

Q: What breaks when an AI assistant can manage users, tenants, and auth flows?

A: The normal separation between inquiry and administration breaks down. Once the assistant can inspect state and then modify that same state, a small prompt or mistaken instruction can produce a privileged change with broad downstream impact on authentication and access.

Q: Which controls matter most for AI assistants in identity operations?

A: Tool scoping, consent design, auditability, and revocation. If those controls are weak, an assistant can become an unreviewed administrative proxy rather than a bounded helper, especially when it can reach both read and write functions in the same session.

How it works in practice

How MCP exposes identity operations to AI assistants

The Model Context Protocol connects an assistant to external tools through a standardised interface, and in this case those tools map directly to identity functions such as users, tenants, flows, audit logs, and access keys. The important design point is that the assistant is not merely answering questions about identity. It is operating against live administrative surfaces with tool-specific read and write scopes. That makes MCP a governance interface as much as a technical integration layer.

Practical implication: treat every MCP tool as an identity control surface and classify it by read, write, and escalation risk before enabling it.

Why natural-language administration changes privilege boundaries

Natural-language control removes the usual friction of clicking through admin consoles, which speeds up work but also compresses the moment where a human operator notices they are about to make a high-risk change. When an assistant can inspect configuration, propose changes, and request elevation inside the same conversation, privilege becomes more fluid than in a traditional admin session. The operational challenge is not whether the action is technically permitted, but whether the request path, approval path, and audit path stay separable.

Practical implication: separate conversational intent from administrative execution so that elevation and audit remain explicit, not implicit.

Why agent-facing identity APIs need tighter write controls

The tool set includes functions for sessions, access controls, auth keys, flows, tenants, connect settings, and users, which are exactly the parts of the stack where a small error can create wide blast radius. Read-only access is safer by default, but the existence of write tools means the control problem shifts to permission scoping, consent handling, and approval design. In identity infrastructure, the risk is not only exposure of secrets. It is also unintended changes to authentication and authorisation logic that affect every downstream login or access decision.

Practical implication: build separate policies for read tools and write tools, and require explicit approval for any function that changes auth or access state.

NHI Mgmt Group analysis

Agent-mediated identity administration turns privilege into a conversational control problem. When an assistant can inspect configuration, manage tenants, and modify authentication flows, the security question is no longer only who has access. It becomes who can cause access to change through a model-mediated request path. That expands the blast radius of a single interaction and forces identity teams to govern the conversation as carefully as the backend system.

Least privilege has to be expressed at the tool boundary, not just the platform boundary. The article describes 23 tools with separate read and write modes, which is the right architectural clue for practitioners. In an MCP world, the meaningful control is not whether the assistant is broadly connected. It is whether each tool is independently constrained, logged, and revocable. That aligns directly with OWASP NHI thinking on scoped machine access.

Consent and escalation flows become security controls, not just user experience steps. If Claude or ChatGPT can ask for elevated permissions inside the session, then the consent journey is part of the trust model. That means approval design, tenant selection, and identity confirmation are not peripheral features. They are governance points that determine whether the assistant is acting as a bounded operator or a proxy with expanding reach.

Natural-language access can accelerate shadow AI unless inventory and audit are continuous. The moment admins can connect agents to identity infrastructure without a common approval pattern, undiscovered or weakly governed agent pathways become more plausible. The result is a new class of shadow AI risk, where the issue is not only the presence of an agent but the unreviewed administrative surface it can reach. Practitioners should treat every connected assistant as an identity subject with measurable scope.

Named concept: conversational privilege drift. This is the gradual expansion of what an assistant can do as users normalise requests, approvals, and delegated actions inside a chat interface. The drift is subtle because each step can look individually reasonable, yet the cumulative effect is broader authority than the organisation intended. For identity programmes, that means governance must track not just standing access, but how conversations reshape effective privilege over time.

From our research:

• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
• That same research also shows 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.

What this signals

Conversational privilege drift: identity teams should expect AI assistants to accumulate effective authority faster than traditional admin roles if tool boundaries are not explicit. The practical response is to map every assistant path into the same governance model used for privileged human administration, then extend it to read-only and write-capable tool classes.

The immediate programme signal is that identity architecture, audit, and consent design now converge in one place. If a connector can inspect and change identity state, your IAM programme needs a control model for agent-mediated actions, not just for human users and service accounts.

For practitioners

• Inventory every MCP tool by risk tier Classify each tool as read, write, or escalation-capable before enabling it for production use, and require separate approval for tools that can change users, tenants, flows, or auth keys.
• Split conversational intent from administrative execution Keep model prompts, approval prompts, and backend writes on separate control paths so a natural-language request cannot directly become a privileged change without explicit review.
• Restrict write access to identity infrastructure Default assistants to read-only access for documentation and audit tasks, then allow write operations only for narrowly defined admin roles with strong logging and rollback controls.
• Monitor for shadow AI connections to identity systems Maintain a live inventory of every assistant, connector, and plugin that can touch identity data or authentication settings, including tenant-specific grants and delegated consent.
• Review elevation and consent journeys as controls Treat tenant selection, permission elevation, and consent prompts as security checkpoints, not UI steps, and verify that every elevated action is attributable to a named operator.

Key takeaways

• AI assistants that can administer identity systems turn conversational access into a governance issue, not just a usability feature.
• Scoped tool permissions, elevation journeys, and audit trails are the controls that decide whether an assistant remains bounded or becomes an administrative proxy.
• The fastest way to reduce risk is to inventory every connector, classify write tools separately, and require explicit approval for identity changes.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Conversational privilege drift: The gradual expansion of effective authority as users normalise asking an assistant to perform more sensitive actions. The drift is dangerous because each request can look justified on its own, while the cumulative result is broader access than the organisation intended.
• Agent-mediated administration: Administration performed through an AI assistant that can inspect systems, request elevation, and execute tasks on a user's behalf. The identity risk is that the assistant may function as a proxy with real operational power unless its tool scopes, approvals, and audit trails are tightly controlled.
• Write-capable tool boundary: The point at which a connected assistant can move from observing identity state to changing it. This boundary is critical because write access to users, tenants, flows, or keys can create broad blast radius if approval, logging, and rollback are not separated and enforced.

What's in the full announcement

Descope's full post covers the operational detail this post intentionally leaves for the source:

• The exact Claude and ChatGPT connection steps for enabling the MCP Server in each supported client.
• The full 23-tool catalog with read and write scope details for identity operations.
• The auth and consent flow mechanics for tenant selection and elevated access requests.
• The platform-specific setup guidance for agents outside the Anthropic and OpenAI ecosystems.

👉 The full Descope post covers connector setup, tool scopes, and auth flows for identity administration.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.