Descope: an authorization server that pairs with your gateway
In short: Descope is not an MCP gateway, so we do not score it. It is an authorization server that plugs into any policy enforcement point, such as a gateway, an MCP server or an API. It names per-tool authorization, short-lived scoped tokens, OAuth 2.1, PKCE, CIMD and XAA/ID-JAG.
| Parameter | Value | Source |
|---|---|---|
| Product type | Authorization server for any policy enforcement point | [ds-hub] |
| Enforcement points | Gateway, MCP server or API | [ds-hub] |
| Authorization | Per-tool; short-lived scoped tokens | [ds-hub3] |
| Standards named | OAuth 2.1, PKCE, MCP authorization, CIMD, XAA/ID-JAG, SPIFFE | [ds-hub3] |
| Free tier | Free Forever tier includes the hub | [ds-hub3] |
| Scored here | No: not a gateway | [ds-hub] |
Why is Descope not in the selection table?
Our rubric scores the enforcement point on each tool call. Descope issues tokens and decides scopes, and leaves enforcement to a gateway, server or API. Scoring it on brokering, approval and registry would misread what it does.
Which gateway should I pair it with?
Any gateway that validates tokens from an external authorization server. Read gateway or authorization server for the trade-offs.
Sources
- Descope Agentic Identity Hub [ds-hub] read 2026-11-03
- Descope Agentic Identity Hub 3 [ds-hub3] read 2026-11-03
By The Datasheet desk · Published and reviewed 2026-11-03