---
title: "Descope MCP server for AI agents - actionlake"
description: "Give Claude 443 Descope actions through one MCP server: users, SSO, outbound apps, tenants. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/descope
updated: 2026-10-23
---

Connectors · Identity & security

# Descope MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Descope and the rest of your systems. It gives your agent 443 Descope actions (149 reads, 202 writes and 92 that wait for a confirmation) and holds the Descope credential itself, so the agent never does. It paces Descope's limits and records every call.

[Connect Descope free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "descope.groups.load_groups",
  intent: "check which Descope account is connected"
}
# Load All External Groups for a Tenant · read · 1 upstream call
```

- 443 actions in one signed file
- 149 read look, never change
- 202 write create and update
- 92 wait for a yes destructive, confirmed first

Set up

## Connect Descope in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Descope.
   API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `project_id` Descope Project ID (Project Settings in the Descope console, starts with P)
   - `management_key` Descope Management Key (Company > Management Keys)
   - `host` Where your Descope lives: your host
   ```
   account { op: "connections.requirements", service: "descope" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "descope.groups.load_groups" }
   # load all external groups for a tenant · read · 1 upstream call
   check { action: "descope.users.create_user", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Descope at a glance

**Sign-in**

API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`project_id` `management_key`

**Setup fields**

`host`

**Limits we pace to**

100 calls a minute, per connection

**API covered**

Descope API 0.0.1 (OpenAPI 3.0.3)`api.descope.com`

**Built from**

Descope's documentation, read 23 October 2026[docs.descope.com](https://docs.descope.com/examples/Descope_API.yaml) [docs.descope.com](https://docs.descope.com/api)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

113 of 149 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

3, so ask can line Descope up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Descope.

443 actions in 45 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **149** read look, never change
- **202** write create and update
- **92** destructive wait for a confirmation

1. ### Users
   61
   12 read · 34 write · 15 destructive
   Create User · Search Users · Load User · Update User
2. ### SSO
   37
   9 read · 21 write · 7 destructive
   Add a named SSO application secret · Create SSO application custom attribute definitions · Create SSO application permission · Create SSO application role
3. ### Outbound apps
   25
   8 read · 13 write · 4 destructive
   Batch Upload Outbound App Tenant OAuth Tokens · Batch Upload Outbound App User OAuth Tokens · Create Outbound App · Create outbound application according to existing dcr preset
4. ### Tenants
   23
   7 read · 11 write · 5 destructive
   Create Tenant · Create Tenants Batch · Generate SSO Admin Link (v2) · Generate Tenant Admin SSO Link (Deprecated)
5. ### Fga
   21
   13 read · 5 write · 3 destructive
   Create FGA Backup · Get FGA Relations · Save FGA Schema · List FGA Backups
6. ### Third party apps
   19
   6 read · 7 write · 6 destructive
   Add a named third party application secret · Create third party application · Create third party application (v2) (v2) · Load All third party applications
7. ### Authz
   18
   8 read · 4 write · 6 destructive
   Create a list of authz relations · Return the list of targets and resources changed since the given date · Load an authz schema · Delete an authz namespace
8. ### Projects
   18
   7 read · 9 write · 2 destructive
   Clone Project · Clone Project (Async) · Create Project · Import Project

**37 more areas · 221 actions**

- Auth access **16**
- Access keys **15**
- Lists **14**
- MCP servers **14**
- Families **13**
- Resources **13**
- Flows **12**
- JWT **10**
- Agentic identities **8**
- Policies **8**
- Roles **8**
- Permissions **7**
- Engines **6**
- Descopers **5**
- Management keys **5**
- Oauth **5**
- Scim **5**
- Auth settings **4**
- Connectors **4**
- Localization **4**
- Otp **4**
- Password **4**
- Templates **4**
- Widgets **4**
- Groups **3**
- Impersonation **3**
- Scope claim mappings **3**
- Test users **3**
- Admin portal **2**
- Audit **2**
- Embedded links **2**
- Enchanted links **2**
- Magic links **2**
- Passkeys **2**
- Themes **2**
- Totp **2**
- Analytics **1**

Top actions

## The Descope API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 15 of Descope's 15 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `descope.groups.load_groups` Load All External Groups for a Tenant | Load All External Groups for a Tenant. | read | `identity.group.list` 262 connectors |
| `descope.roles.load_all_roles` Load All Roles | Load All Roles. | read | `identity.role.list` 184 connectors |
| `descope.users.create_user` Create User | Create User. | write | `identity.user.create` 262 connectors |
| `descope.users.search_users` Search Users | Search Users. | read | `identity.user.search` 40 connectors |
| `descope.roles.create_role` Create Role | Create Role. | write | `identity.role.create` 105 connectors |
| `descope.users.delete_user` Delete User | Delete User. | destructive | `identity.user.delete` 253 connectors |
| `descope.access_keys.create_access_key` Create Access Key | Create Access Key. | write | `identity.api_key.create` 100 connectors |
| `descope.permissions.load_all_permissions` Load All Permission | Load All Permission. | read | `identity.permission.list` 33 connectors |
| `descope.access_keys.load_access_key` Load An Access Key | Load An Access Key. | read | `identity.api_key.get` 66 connectors |
| `descope.audit.search_audit` Search Audit | Search Audit. | read | `identity.audit_event.search` 7 connectors |
| `descope.flows.list_flows` List/Search Flows | List/Search Flows. | read | this connector |
| `descope.flows.import_flow` Import Flow (v2) | Import Flow (v2). | write | this connector |

Try it

## Prompts to paste into Claude.

Each one names the Descope actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Who has access in Descope? List every user and their role.
   calls `descope.users.search_users`
2. Write write
   Create User in Descope. Show me exactly what you will send before you save it.
   calls `descope.users.create_user`

Governance for Descope

## Destructive actions wait for a yes.

92 Descope actions are destructive. The first 10:

- Delete User `descope.users.delete_user`
- Delete Role `descope.roles.delete_role`
- Delete Access Key `descope.access_keys.delete_access_key`
- Clear List `descope.lists.clear_list`
- Delete flow `descope.flows.delete_flow`
- Delete List `descope.lists.delete_list`
- Delete Flow `descope.flows.delete_flows`
- Batch Delete Roles `descope.roles.delete_roles`
- Batch Delete Users `descope.users.delete_users`
- Delete an authz schema `descope.authz.delete_schema`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do descope.users.delete_user confirm_policy: **human**

Delete User?

**intent:** the user asked me to delete User

run suspended · waiting for a named person · key _descope-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "descope-agent",
  allowed_actions: ["descope.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "descope.users.delete_user", approver: "lead@example.com" },
    { match: "descope.roles.delete_role", approver: "lead@example.com" },
    { match: "descope.access_keys.delete_access_key", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Descope only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Descope costs on actionlake.

Every Descope action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Descope refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 443 Descope actions
- 443 actions page each page of a long list is one call
- 113 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Descope action.

443 actions by area: the id your agent calls, what it does, and its effect.

**Users 61**

- `descope.users.create_user` Create User write
- `descope.users.load_user` Load User read
- `descope.users.search_users` Search Users read
- `descope.users.update_user` Update User write
- `descope.users.create_test_user` Create Test User write
- `descope.users.create_user_custom_attribute` Create a Custom Attributes write
- and 55 more in this area

**SSO 37**

- `descope.sso.add_sso_application_secret` Add a named SSO application secret write
- `descope.sso.create_sso_application_custom_attribute` Create SSO application custom attribute definitions write
- `descope.sso.create_sso_application_permission` Create SSO application permission write
- `descope.sso.create_sso_application_role` Create SSO application role write
- `descope.sso.configure_ss_oauth_type` Enable or disable an SSO configuration write
- `descope.sso.configure_sso_redirect_url` Configure SSO Redirect URL write
- and 31 more in this area

**Outbound apps 25**

- `descope.outbound_apps.batch_upload_outbound_app_tenant_oauth_tokens` Batch Upload Outbound App Tenant OAuth Tokens write
- `descope.outbound_apps.batch_upload_outbound_app_user_oauth_tokens` Batch Upload Outbound App User OAuth Tokens write
- `descope.outbound_apps.create_outbound_app` Create Outbound App write
- `descope.outbound_apps.create_outbound_app_by_dcr_preset` Create outbound application according to existing dcr preset write
- `descope.outbound_apps.create_outbound_app_by_template` Create outbound application by existing template write
- `descope.outbound_apps.create_outbound_scim_configuration` Create outbound SCIM configuration write
- and 19 more in this area

**Tenants 23**

- `descope.tenants.create_tenant` Create Tenant write
- `descope.tenants.create_tenants_batch` Create Tenants Batch write
- `descope.tenants.generate_tenant_admin_link_sso` Generate SSO Admin Link (v2) write
- `descope.tenants.generate_tenant_admin_link_sso_deprecated` Generate Tenant Admin SSO Link (Deprecated) write
- `descope.tenants.configure_tenant_settings` Update Tenant Session Settings write
- `descope.tenants.delete_tenant` Delete Tenant destructive
- and 17 more in this area

**Fga 21**

- `descope.fga.create_fga_backup` Create FGA Backup write
- `descope.fga.create_fga_relations` Get FGA Relations write
- `descope.fga.create_fga_schema` Save FGA Schema write
- `descope.fga.list_fga_backups` List FGA Backups read
- `descope.fga.auth_zen_action_search` AuthZEN Action Search read
- `descope.fga.auth_zen_evaluation` AuthZEN Access Evaluation read
- and 15 more in this area

**Third party apps 19**

- `descope.third_party_apps.add_third_party_application_secret` Add a named third party application secret write
- `descope.third_party_apps.create_third_party_application` Create third party application write
- `descope.third_party_apps.create_third_party_application_v2` Create third party application (v2) (v2) write
- `descope.third_party_apps.load_all_third_party_applications` Load All third party applications read
- `descope.third_party_apps.delete_third_party_application` Delete third party application destructive
- `descope.third_party_apps.delete_third_party_application_consents` Delete third party application consents destructive
- and 13 more in this area

**Authz 18**

- `descope.authz.create_relations` Create a list of authz relations write
- `descope.authz.delete_namespace` Delete an authz namespace destructive
- `descope.authz.get_modified` Return the list of targets and resources changed since the given date read
- `descope.authz.load_schema` Load an authz schema read
- `descope.authz.delete_relation_definition` Delete an authz relation definition destructive
- `descope.authz.delete_relations` Delete a list of authz relations destructive
- and 12 more in this area

**Projects 18**

- `descope.projects.clone_project` Clone Project write
- `descope.projects.clone_project_async` Clone Project (Async) write
- `descope.projects.create_project` Create Project write
- `descope.projects.import_project` Import Project write
- `descope.projects.delete_project` Delete Project destructive
- `descope.projects.delete_project_post` Delete Project destructive
- and 12 more in this area

**Auth access 16**

- `descope.auth_access.create_auth_access_rule` Create auth access policy rule write
- `descope.auth_access.create_tenant_auth_access_rule` Create tenant auth access policy rule write
- `descope.auth_access.load_all_auth_access_rules` Load all auth access policy rules read
- `descope.auth_access.load_all_tenant_auth_access_rules` Load all tenant auth access policy rules read
- `descope.auth_access.delete_auth_access_rule` Delete auth access policy rule destructive
- `descope.auth_access.delete_tenant_auth_access_rule` Delete tenant auth access policy rule destructive
- and 10 more in this area

**Access keys 15**

- `descope.access_keys.create_access_key` Create Access Key write
- `descope.access_keys.delete_access_key` Delete Access Key destructive
- `descope.access_keys.import_access_keys` Import Access Key write
- `descope.access_keys.load_access_key` Load An Access Key read
- `descope.access_keys.activate_access_key` Activate Access Key write
- `descope.access_keys.activate_access_keys` Batch Activate Access Keys write
- and 9 more in this area

**Lists 14**

- `descope.lists.add_ips_to_list` Add IPs to List write
- `descope.lists.add_texts_to_list` Add Texts to List write
- `descope.lists.create_list` Create List write
- `descope.lists.get_all_lists` Get All Lists read
- `descope.lists.check_ip_in_list` Check IP in List read
- `descope.lists.check_text_in_list` Check Text in List read
- and 8 more in this area

**MCP servers 14**

- `descope.mcp_servers.create_mcp_server` Create MCP Server write
- `descope.mcp_servers.create_mcp_server_client` Create MCP Server Client write
- `descope.mcp_servers.load_all_mcp_servers` Load All MCP Servers read
- `descope.mcp_servers.search_mcp_server_clients` Search MCP Server Clients read
- `descope.mcp_servers.delete_mcp_server` Delete MCP Server destructive
- `descope.mcp_servers.delete_mcp_server_client` Delete MCP Server Client destructive
- and 8 more in this area

**Families 13**

- `descope.families.create_family` Create Family write
- `descope.families.create_family_custom_attribute` Create Family Custom Attribute write
- `descope.families.create_family_dependent` Create Family Dependent write
- `descope.families.impersonate_family_dependent` Impersonate Family Dependent write
- `descope.families.delete_family` Delete Family destructive
- `descope.families.delete_family_custom_attribute` Delete Family Custom Attribute destructive
- and 7 more in this area

**Resources 13**

- `descope.resources.create_dynamic_registration_template` Create dynamic registration template write
- `descope.resources.create_resource` Create resource write
- `descope.resources.load_all_dynamic_registration_templates` Load all dynamic registration templates read
- `descope.resources.load_all_resources` Load all resources read
- `descope.resources.delete_dynamic_registration_template` Delete dynamic registration template destructive
- `descope.resources.delete_dynamic_registration_templates` Delete dynamic registration templates destructive
- and 7 more in this area

**Flows 12**

- `descope.flows.import_flow` Import Flow (v2) write
- `descope.flows.list_flow_templates` List Flow Templates read
- `descope.flows.list_flows` List/Search Flows read
- `descope.flows.run_management_flow` Run Management Flow write
- `descope.flows.complete_external_auth_flow` Complete External Authentication write
- `descope.flows.delete_flow` Delete flow destructive
- and 6 more in this area

**JWT 10**

- `descope.jwt.apply_jwt_template_from_library` Apply JWT Template From Library write
- `descope.jwt.create_jwt_template` Create JWT Template write
- `descope.jwt.list_jwt_template_library` List JWT Template Library read
- `descope.jwt.list_jwt_templates` List JWT Templates read
- `descope.jwt.delete_jwt_template` Delete JWT Template destructive
- `descope.jwt.load_jwt_template` Load JWT Template read
- and 4 more in this area

**Agentic identities 8**

- `descope.agentic_identities.create_governance_access_request` Create governance access request write
- `descope.agentic_identities.get_governance_access_request` Get governance access request read
- `descope.agentic_identities.search_agentic_identities` Search agentic identities read
- `descope.agentic_identities.search_governance_access_requests` Search governance access requests read
- `descope.agentic_identities.get_governance_settings` Get governance settings read
- `descope.agentic_identities.resolve_governance_access_request` Resolve governance access request write
- and 2 more in this area

**Policies 8**

- `descope.policies.create_policy_rule` Create policy rule write
- `descope.policies.load_policy_rule` Load policy rule read
- `descope.policies.load_policy_rule_settings` Load policy rule settings read
- `descope.policies.search_policy_rules` Search policy rules read
- `descope.policies.delete_policy_rule` Delete policy rule destructive
- `descope.policies.reorder_policy_rule` Reorder a policy rule write
- and 2 more in this area

**Roles 8**

- `descope.roles.create_role` Create Role write
- `descope.roles.delete_role` Delete Role destructive
- `descope.roles.load_all_roles` Load All Roles read
- `descope.roles.update_role` Update Role write
- `descope.roles.create_roles` Bulk Create Roles write
- `descope.roles.delete_roles` Batch Delete Roles destructive
- and 2 more in this area

**Permissions 7**

- `descope.permissions.create_permission` Create Permission write
- `descope.permissions.create_permissions` Bulk Create Permissions write
- `descope.permissions.load_all_permissions` Load All Permission read
- `descope.permissions.update_permission` Update Permission write
- `descope.permissions.delete_permission` Delete Permission destructive
- `descope.permissions.delete_permissions` Bulk Delete Permissions destructive
- and 1 more in this area

**Engines 6**

- `descope.engines.create_engine` Create engine write
- `descope.engines.load_engine` Load engine by ID read
- `descope.engines.load_engines` Load all engines read
- `descope.engines.update_engine` Update engine write
- `descope.engines.delete_engine` Delete engine destructive
- `descope.engines.rotate_engine_secret` Rotate engine secret destructive

**Descopers 5**

- `descope.descopers.create_descopers` Create Descoper write
- `descope.descopers.get_descoper` Get Descoper read
- `descope.descopers.list_descopers` List Descopers read
- `descope.descopers.update_descoper` Update Descoper write
- `descope.descopers.delete_descoper` Delete Descoper destructive

**Management keys 5**

- `descope.management_keys.create_management_key` Create Management Key write
- `descope.management_keys.get_management_key` Get Management Key read
- `descope.management_keys.search_management_keys` Search Management Keys read
- `descope.management_keys.update_management_key` Update Management Key write
- `descope.management_keys.delete_management_keys` Delete Management Key destructive

**Oauth 5**

- `descope.oauth.get_oauth_provider` Get OAuth provider read
- `descope.oauth.get_oauth_settings` Get OAuth settings read
- `descope.oauth.set_oauth_provider` Set OAuth provider write
- `descope.oauth.set_oauth_settings` Set OAuth settings write
- `descope.oauth.delete_oauth_provider` Delete OAuth provider destructive

**Scim 5**

- `descope.scim.activate_scim_access_keys` Activate SCIM Access Keys write
- `descope.scim.create_scim_access_key` Create SCIM Access Key write
- `descope.scim.load_scim_access_keys` Load SCIM Access Keys read
- `descope.scim.revoke_scim_access_keys` Revoke SCIM Access Keys destructive
- `descope.scim.rotate_scim_access_key` Rotate SCIM Access Key destructive

**Auth settings 4**

- `descope.auth_settings.anonymous` Anonymous User write
- `descope.auth_settings.generate_jwt_sign_in` Generate JWT for Sign-In write
- `descope.auth_settings.generate_jwt_sign_up` Generate JWT for Sign-Up write
- `descope.auth_settings.generate_jwt_sign_up_or_in` Generate JWT for Sign-Up or Sign-In write

**Connectors 4**

- `descope.connectors.create_connector` Create connector write
- `descope.connectors.delete_connector` Delete connector destructive
- `descope.connectors.get_connector` Get connector read
- `descope.connectors.update_connector` Update connector write

**Localization 4**

- `descope.localization.export_flow_localization` Export Flow Localization read
- `descope.localization.export_messaging_template_localization` Export Messaging Localization read
- `descope.localization.import_flow_localization` Import Flow Localization write
- `descope.localization.import_messaging_localization` Import Messaging Localization write

**Otp 4**

- `descope.otp.get_otp_settings` Get OTP settings read
- `descope.otp.get_tenant_otp_settings` Get OTP Settings for a tenant read
- `descope.otp.set_otp_settings` Set OTP settings write
- `descope.otp.set_tenant_otp_settings` Set OTP Settings for a tenant write

**Password 4**

- `descope.password.configure_password_settings` Update Tenant Password Settings write
- `descope.password.get_password_settings` Get Tenant Password Settings read
- `descope.password.get_password_settings_v2` Get password settings (v2) read
- `descope.password.set_password_settings_v2` Set password settings (v2) write

**Templates 4**

- `descope.templates.create_messaging_template` Create template write
- `descope.templates.delete_messaging_template` Delete template destructive
- `descope.templates.get_messaging_template` Get template read
- `descope.templates.update_messaging_template` Update template write

**Widgets 4**

- `descope.widgets.delete_widget` Delete widget destructive
- `descope.widgets.get_widget` Get widget read
- `descope.widgets.list_widgets` List all widgets read
- `descope.widgets.set_widget` Set widget write

**Groups 3**

- `descope.groups.load_group_members` Load All Members of a specific External Group read
- `descope.groups.load_groups` Load All External Groups for a Tenant read
- `descope.groups.load_member_groups` Load All External Groups for Specific Members read

**Impersonation 3**

- `descope.impersonation.impersonate` Impersonate User write
- `descope.impersonation.impersonate_stepup` Impersonate Stepup write
- `descope.impersonation.stop_impersonation` Stop Impersonation destructive

**Scope claim mappings 3**

- `descope.scope_claim_mappings.delete_scope_claim_mapping` Delete Scope Claim Mapping destructive
- `descope.scope_claim_mappings.get_scope_claim_mapping` Get Scope Claim Mapping read
- `descope.scope_claim_mappings.set_scope_claim_mapping` Set Scope Claim Mapping write

**Test users 3**

- `descope.test_users.generate_enchanted_link_for_test_user` Generate Enchanted Link write
- `descope.test_users.generate_magic_link_for_test_user` Generate Magic Link write
- `descope.test_users.generate_otp_for_test_user` Generate OTP write

**Admin portal 2**

- `descope.admin_portal.get_admin_portal_settings` Get admin portal settings read
- `descope.admin_portal.set_admin_portal_settings` Set admin portal settings write

**Audit 2**

- `descope.audit.create_audit_event` Create Audit Event write
- `descope.audit.search_audit` Search Audit read

**Embedded links 2**

- `descope.embedded_links.get_embedded_link_settings` Get embedded link settings read
- `descope.embedded_links.set_embedded_link_settings` Set embedded link settings write

**Enchanted links 2**

- `descope.enchanted_links.get_enchanted_link_settings` Get enchanted link settings read
- `descope.enchanted_links.set_enchanted_link_settings` Set enchanted link settings write

**Magic links 2**

- `descope.magic_links.get_magic_link_settings` Get magic link settings read
- `descope.magic_links.set_magic_link_settings` Set magic link settings write

**Passkeys 2**

- `descope.passkeys.get_passkey_settings` Get passkey settings read
- `descope.passkeys.set_passkey_settings` Set passkey settings write

**Themes 2**

- `descope.themes.export_theme` Export Theme (v2) read
- `descope.themes.import_theme` Import Theme (v2) write

**Totp 2**

- `descope.totp.get_totp_settings` Get TOTP settings read
- `descope.totp.set_totp_settings` Set TOTP settings write

**Analytics 1**

- `descope.analytics.search_analytics` Search Analytics read

This index shows a sample of each area. All 443 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search.

Questions

## The Descope MCP server, answered.

**Is there a Descope MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 443 Descope actions across users, SSO, outbound apps and tenants, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Descope.

**What do I need to connect Descope?**

Descope Project ID (Project Settings in the Descope console, starts with P) and Descope Management Key (Company > Management Keys). Plus your host. The free call account { op: "connections.requirements", service: "descope" } lists exactly what to paste.

**Can an AI agent delete or change things in Descope?**

Only if its key allows it, and only with an explicit confirmation. 92 Descope actions are destructive, including delete User, delete Role and delete Access Key. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Descope API limit?**

actionlake paces every call to the limits in the Descope service file: 100 calls a minute per connection. Repeated reads are answered from cache (113 Descope actions can be), which never reaches Descope.

**What does a Descope action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (443 Descope actions page). Cache hits, searches, dry runs and calls Descope refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Descope API does it cover?**

The Descope API 0.0.1 (OpenAPI 3.0.3) at api.descope.com by default, or the base URL set when you connect. It is built from Descope's documentation as read on 23 October 2026. 443 actions in 45 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Descope data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Descope credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Descope

Shares the most action names with

- [Panther 11](https://actionlake.com/connectors/panther)
- [Trend Vision One 10](https://actionlake.com/connectors/trend-vision-one)
- [Keycloak Admin REST API 9](https://actionlake.com/connectors/keycloak-admin-rest-api)
- [Expel Workbench 7](https://actionlake.com/connectors/expel-workbench)
- [Zscaler Internet Access (ZIA) 6](https://actionlake.com/connectors/zscaler-internet-access-zia)
- [BeyondTrust Password Safe 6](https://actionlake.com/connectors/beyondtrust-password-safe)

Joins with, on shared entities

- [HaloPSA 3](https://actionlake.com/connectors/halopsa)
- [Fortinet FortiGate 3](https://actionlake.com/connectors/fortinet-fortigate)
- [Genesys Cloud CX 3](https://actionlake.com/connectors/genesys-cloud-cx)
- [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud)
- [Delinea Secret Server 3](https://actionlake.com/connectors/delinea-secret-server)
- [authentik 3](https://actionlake.com/connectors/authentik)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Descope; the name is the vendor's own. Counts are from the Descope service file, version 1.0.0.

## Give your agent Descope today.

[Connect Descope free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/descope
More: https://actionlake.com/llms.txt