Identity for AI

Secure an MCP server with PingGateway

When securing any MCP server, implementing an appropriate, consistent, documented, auditable, and adaptable security model can be challenging.

PingGateway acts as an MCP gateway in your AI security architecure.

In this architecture, PingGateway:

  1. Intercepts and validates an MCP request from an AI agent to an MCP server. It optionally audits and throttles traffic.

  2. Authorizes the AI agent request using OAuth 2.0.

  3. Protects the MCP server by enforcing OAuth 2.0 scopes. It optionally acts as a policy decision point and transforms security tokens.

PingGateway addresses the challenges in protecting any MCP server by providing a unified layer to:

  • Allow only valid MCP requests.

  • Audit MCP requests and actors.

  • Throttle request rates.

  • Enforce coarse-grained OAuth 2.0 security controls.

  • Enforce fine-grained access control policies.

  • Perform token transformation mapped to your security models.

The MCP security gateway tutorial in the PingGateway documentation shows how to protect any MCP server with PingOne Advanced Identity Cloud acting as the OAuth 2.0 authorization server.