Build with AI

Security, governance, and administrative controls

Overview and general guidance

The AIC Remote MCP Server gives an AI client administrative access to your PingOne Advanced Identity Cloud environment. Tool outputs are returned to the AI client and might be included in prompts sent to a large language model (LLM) provider. Use the AIC Remote MCP Server only with trusted MCP clients, trusted AI agents, and approved AI endpoints. For general disclaimers on AI-generated output, refer to Disclaimers and Limitations.

  • Protect sensitive data. Before enabling the server on an environment, evaluate the sensitivity of that environment’s configuration and identity data. Tool outputs might contain configuration information, application settings, identity details, and other administrative metadata that could be transmitted to an external AI provider as part of the client workflow.

  • Request only the scopes you need. Narrower scope sets limit what the server is permitted to do on your behalf. Refer to Scopes.

Security layers

Layer What it does

Stateless JWT validation

Bearer tokens are verified against the PingOne Advanced Identity Cloud JWKS endpoint on every request. No server-side token storage.

OAuth 2.0 authentication

Your MCP client authenticates users through OAuth 2.0 authorization code with PKCE. The server never handles user credentials directly.

Scoped-down execution tokens

For each downstream API call, the server performs an RFC 8693 token exchange to obtain a token narrowed to the specific scope the tool needs. The original Bearer token is not passed to PingOne Advanced Identity Cloud APIs directly.

User-based authentication

Every API call is authenticated as the user who logged in, producing audit trails attributed to that individual.

Tenant isolation

Tokens are validated against the configured PingOne Advanced Identity Cloud tenant URL to prevent accidental cross-tenant operations.

Tool exposure is also gated by environment tier and by the OAuth scopes on the Bearer token. Refer to Tool exposure.

Server enablement and default state

  • Disabled by default. The AIC Remote MCP Server is turned off by default across all PingOne Advanced Identity Cloud tenants.

  • Human administrator required. AI agents do not have access to any tools capable of enabling or disabling the AIC Remote MCP Server.

  • Content Security Policy. If your tenant enforces a Content Security Policy, the form-action directive must include each MCP client’s OAuth redirect URI, or sign-in will fail. Refer to Content Security Policy (CSP).

Tool exposure

  • Environment tier gates tool exposure. When the server is enabled, tool availability is determined by the PingOne Advanced Identity Cloud environment tier. Sandbox and Development receive the full read, write, and delete tool set. UAT, Staging, and Production receive read-only tools plus the report-authoring tools.

  • Roles gate what a user can do. The tools an AI session can invoke are further constrained by the administrative roles assigned to the authenticated user and the OAuth scopes present on the Bearer token. Refer to Scopes.

  • Production usage. When available, enabling the server in Production exposes read-only and report-authoring tools only. Review the tool set for a tier before enabling in that tier.

    The AIC Remote MCP Server is currently available in Rapid (Sandbox) environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks.

Execution boundaries and token isolation

  • Token isolation. The OAuth access token resides exclusively within the client transport layer. It is never passed to, accessible by, or readable within the LLM prompt context.

  • Execution boundary. The AI agent operates strictly by generating structured JSON tool calls. It cannot make arbitrary direct HTTP requests to PingOne Advanced Identity Cloud REST endpoints or alter its token permissions. If a tool does not exist or is not exposed, the agent has no technical mechanism to execute that action.

Auditability and SIEM logging

Every action taken through the AIC Remote MCP Server is executed with a token issued to the authenticated administrator. PingOne Advanced Identity Cloud records that action in its audit logs against the individual user identity, not a service account.

OAuth clients used by the server

The AIC Remote MCP Server uses two pre-registered OAuth 2.0 clients:

Client ID Purpose

AICRemoteMCPClient

Public client used by the MCP client for the interactive user login (authorization code + PKCE). This is the client ID you reference in your MCP client configuration.

AICRemoteMCPExchangeClient

Confidential client used by the server itself to obtain scoped-down tokens for each tool call through RFC 8693 token exchange.

Dual-context attribution

Every audit event produced through the AIC Remote MCP Server carries two identifiers:

  • User context: The individual human administrator who authenticated the session.

  • Client context: The OAuth client ID (AICRemoteMCPClient or AICRemoteMCPExchangeClient).

SIEM operations teams can filter by client ID to isolate, baseline, and monitor AI-assisted administrative activity separately from direct admin console or automation activity.

Tracing an action to the MCP server

To determine whether a change in your tenant was made through the AIC Remote MCP Server:

  1. Identify the user. Every action is attributed to the authenticated administrator. Query the PingOne Advanced Identity Cloud admin console for logs against that user in the relevant time window.

  2. Filter by client ID. Filter the am-authentication log source for AICRemoteMCPClient or AICRemoteMCPExchangeClient to surface all MCP authentication and token-exchange events.

  3. Inspect the audit event. Configuration changes (journeys, scripts, OIDC apps, AM services, identity providers, CORS policies) appear in AM audit logs. Identity and IDM operations (managed objects, email templates, terms and conditions, password policy) appear in IDM audit logs. All are attributed to the user identity.

You can use an AI client connected to the AIC Remote MCP Server itself to query MCP activity. Try prompts like "Show me all am-authentication logs from the last hour where the client ID is AICRemoteMCPClient or AICRemoteMCPExchangeClient" or "Find configuration changes made in my tenant since yesterday".