Custom MCP servers
In short: if you build MCP servers, follow MCP authorization with OAuth 2.1 and PKCE. The July 2026 specification replaces Dynamic Client Registration with CIMD. For servers you consume, a gateway that checks every call keeps policy in one place instead of in each server.
What does Custom MCP servers already give you for agent identity?
- The 28 July 2026 MCP specification: stateless core, header routing for gateways, CIMD replaces DCR. MCP specification update, 28 July 2026, read 2026-11-03
- Enterprise-Managed Authorization is an MCP extension, based on XAA. MCP Enterprise-Managed Authorization, read 2026-11-03
Where is the gap?
The specification defines how to authorize. It does not decide which agent may call which tool for which person.
Which key results usually apply?
Which products fit?
| Product | Fits when |
|---|---|
| NewCore | You need a named person to approve risky agent actions before they run. |
| Descope | You build MCP servers or apps and need MCP authorization, CIMD and PKCE handled. |
| Aembit | You want to start free with a few agents. |
| Silverfort | You run both Okta and Entra ID and want one view of agents across them. |
| Idira | You already run CyberArk or Palo Alto Networks and want agent access in the same estate. |
Questions buyers ask
Do I still need Dynamic Client Registration?
The July 2026 MCP update states CIMD replaces DCR.
Who supports MCP authorization?
Descope names MCP authorization, CIMD and PKCE.
Should each server enforce its own policy?
A gateway can apply one policy across all servers, including third-party ones.