Identity platform startup Stytch Inc. today unveiled Remote MCP Authorization, a new service created in partnership with Cloudflare Inc. that allows developers to add authorization to Remote MCP Servers built on Cloudflare Workers and any other frameworks supporting MCP Servers.

Model Context Protocol, or MCP, is a communications standard developed by Anthropic PBC that allows artificial intelligence agents, such as those powered by large language models, to interact with external applications and services. MCP lets agents dynamically discover what a server can do, allowing them to perform complex workflows by calling application programming interfaces or triggering actions in third-party apps.

Remote MCP extends MCP to allow AI agents to communicate with web applications. The ability to do so makes it easier for developers to enable secure, real-time interaction between agents and external services over the internet.

Stytch’s new service, offered as part of its existing Connected Apps offering, addresses a key challenge in Remote MCP – secure agent authorization. The offering builds on top of Cloudflare’s recently launched workers-mcp package that provides the underlying infrastructure for transport and state management. Stytch brings OAuth 2.0-based authorization to the party to ensure agents act only within tightly scoped permissions.

“While Cloudflare provides the foundation for Remote MCP servers, there are still several key challenges for handling Remote MCP Authorization, namely in secure and robust authorization for these AI agents,” Stytch wrote in a blog post. “With today’s launch, Stytch Connected Apps solves this last problem by enabling Remote MCP authorization via OAuth.”

Stytch Connected Apps supports Dynamic Client Registration and Authorization Server Metadata, allowing AI agents to register and authenticate autonomously with MCP servers. Doing so eliminates the need for manual setup and makes it easier to scale secure integrations across many applications.

The platform also includes advanced features for managing client lifecycles, assigning granular scopes and enabling information technology administrators to review or revoke access.

Stytch supports both identity provider and relying party models for MCP servers, depending on the developer’s architecture. The service additionally offers end-to-end support for agent-based access control irrespective of whether it’s a standalone MCP deployment or one embedded into existing applications.

As MCP adoption grows, Stytch says, it plans to expand its support with more developer tooling and security enhancements in the coming year. The company is also positioning itself as a foundational identity layer for the emerging world of autonomous software agents.

Image: Stytch