English

AI
MCP
Agent
IdP

What you need to have in place for AI Agent and MCP Integration for your product

In this piece, we explore the latest AI breakthroughs that underscore the urgency of secure agent and MCP integration. We highlight OAuth-based authentication as an important measure for protecting user credentials and explain how Logto can help your product serve as both an MCP server and an identity provider in the rapidly growing AI ecosystem.

Guamian

Product & Design

4/2/20254 min read

Stop wasting weeks on user auth

Launch secure apps faster with Logto. Integrate user auth in minutes, and focus on your core product.

Get started

How to drive AI transformation and what you need to prepare for your products

I’m been really pumped about the upcoming world of AI evolves and let’s see what are the latest news in

DeepSeek

Chinese startup DeepSeek released DeepSeek-V3-0324, a major upgrade with improved reasoning and coding capabilities—positioning it as a strong OpenAI competitor.

OpenAI Operator

OpenAI launched Operator, an AI agent that can autonomously perform web tasks using a built-in browser. It rolled out to U.S. ChatGPT Pro users.

Manus

Chinese AI startup introduced Manus, a government-approved AI assistant positioned as the world’s first general-purpose AI agent with real autonomy. Backed by big names like Alibaba.

MCP (Model Context Protocol)

Originally launched by Anthropic, MCP became the open standard for connecting AI agents to external tools and APIs. In March 2025, OpenAI adopted MCP in its ecosystem, boosting interoperability.

Many AI and agent builders are feeling FOMO and uncertainty about their current products. They’re asking:

How should we evolve? What technical foundations do we need from day one?

One issue that keeps popping up is surprisingly simple:

AI agents often fail at signing up or logging in.

In a previous article, we broke down real examples of how today’s agents handle authentication—and uncovered major gaps. These issues raise serious concerns around privacy and user security.

In this piece, we’ll go deeper into that topic and what you can do about it. Make sure your product is open standard and enables agent services to access your products.

First: Build secure agent authentication, ensure your agent can safely access third-party services and protect user credentials

Like the previous article we mentioned, in today’s agent auth landscape, there’s still a lack of clear best practices for how agents should securely access third-party services (like MCP servers).

Let’s take a simple example:

Say you’re building an agent that replies to emails on your behalf. There are a few common ways to give the agent access:

Share your email and password directly 🚫 Not recommended — it’s insecure and exposes user credentials.

Use an OAuth consent flow (if the third-party service supports it) ✅ More secure and user-friendly, with fine-grained permission control.

Generate an API key or personal access token and pass it to the agent ⚠️ Easier to implement, but risky if not properly scoped or revoked not consumer friendly.

Each method has trade-offs. We broke them down in more detail in a previous article — check it out if you want a deeper dive into the pros and cons of each approach.

Second: Make your services accessible to AI agents. Ensure you’re MCP-ready and prepared to integrate with agent marketplaces

Looking at the AI ecosystem as a whole, your product should support two-way connections.

As mentioned in the first step, you need secure authentication so your agent can safely connect to third-party services. But that’s only half of it.

Your product should also act as an OAuth provider.

As the AI ecosystem evolves, it’s important that your product can function as an Identity Provider — securely granting agents access — and on the other hand even as an MCP server, enabling agents to contextually perform tasks for your users.

In other words:

Your agent (if you’re building one) should be able to access other services —

but just as importantly, your product should be accessible by other agents as well.

Integrate with agents

One key use case for agents is allowing them to securely access your product.

To enable this, your app can act as an OIDC/OAuth 2.0 Identity Provider. When the agent triggers a consent flow (here ChatGPT acts as an agent), users are shown a consent screen where they can approve the specific permissions the agent is requesting.

This process is securely handled using the OAuth protocol — and platforms like Logto can help power this with built-in Identity Provider (IdP) support.

Whether it’s a plugin for ChatGPT, Claude, DeepSeek, or any third-party AI agent — using Logto as your Identity Provider (IdP) makes it easy to let agents securely access your product.

With proper authentication in place, agents can interact with your services safely and with user consent.

Intergrate with MCP server

Everyone is talking about MCP servers — and technically, every app can be an MCP server.

A Model Context Protocol (MCP) Server is a backend service that acts as the context manager and orchestrator in an LLM-based agent system.

For example, if you’re building a CMS app and want to make it an MCP server, this allows MCP clients (such as third-party AI agents, IDEs, or LLM-powered tools) to perform contextual tasks on behalf of users. This includes accessing real-time data, executing functions, and interacting with services beyond what’s available in the agent’s static training data.

Having an MCP server with integrated authentication is important — it ensures secure access by LLM agents and proper user consent.

Until now, MCP has mostly worked locally. If you wanted to use web tools, you had to run the server yourself. There was no way for web or mobile apps to easily connect to an MCP server, and more importantly, no way for users to grant consent or allow MCP clients to access their data.

Cursor directly communicates with MCP servers from your local machine, either directly through stdio or via the network using sse. Therefore, MCP servers may not work properly when accessing Cursor over SSH or other development environments. We are hoping to improve this in future releases.

However, even just enabling local MCP servers has already drawn major attention to tools like Cursor — and to the broader potential of MCP.

Now imagine if remote MCP servers were supported, with a web-based interface. That would unlock entirely new workflows — not just for developers, but also for consumer-facing scenarios.

But here’s the important part: When you build a remote MCP server authentication and authorization are important.

Logto is an open-standard authentication provider. By using Logto to manage user identities, you can host your MCP server on platforms like Cloudflare, Railway, or any other hosting provider — and use Logto as your OAuth provider.

This makes it easy for your agent or AI product to integrate with your MCP server securely.

What’s more, your MCP server using Logto can act as both an OAuth client (Service Provider) and an OAuth provider (Identity Provider). Logto allows you to add multiple authentication methods, giving you flexibility to secure your data and handle upstream auth flows however you need.

Connect to marketplaces and the multi-app ecosystem

Even if you’re not building an agent or an MCP server, making your product AI-accessible is becoming essential.

To stay relevant, your product needs to connect with the broader AI ecosystem — by integrating with popular AI marketplaces and tools, and exposing key functionalities in a secure and structured way.

Logto is launching AI initiatives to give developers tailored solutions

With Logto’s flexible infrastructure, we’re actively improving our capabilities and have created a series of tutorials to help developers get the most out of it.

Got questions?

Feel free to contact us — or jump in and get started with Logto today.

Try Logto Cloud for free

How to drive AI transformation and what you need to prepare for your products#

First: Build secure agent authentication, ensure your agent can safely access third-party services and protect user credentials#

Second: Make your services accessible to AI agents. Ensure you’re MCP-ready and prepared to integrate with agent marketplaces#

Integrate with agents#

Intergrate with MCP server#

Connect to marketplaces and the multi-app ecosystem#

Logto is launching AI initiatives to give developers tailored solutions#

How to drive AI transformation and what you need to prepare for your products#

First: Build secure agent authentication, ensure your agent can safely access third-party services and protect user credentials#

Second: Make your services accessible to AI agents. Ensure you’re MCP-ready and prepared to integrate with agent marketplaces#

Integrate with agents#

Intergrate with MCP server#

Connect to marketplaces and the multi-app ecosystem#

Logto is launching AI initiatives to give developers tailored solutions#

How to drive AI transformation and what you need to prepare for your products

First: Build secure agent authentication, ensure your agent can safely access third-party services and protect user credentials

Second: Make your services accessible to AI agents. Ensure you’re MCP-ready and prepared to integrate with agent marketplaces

Integrate with agents

Intergrate with MCP server

Connect to marketplaces and the multi-app ecosystem

Logto is launching AI initiatives to give developers tailored solutions

How to drive AI transformation and what you need to prepare for your products

First: Build secure agent authentication, ensure your agent can safely access third-party services and protect user credentials

Second: Make your services accessible to AI agents. Ensure you’re MCP-ready and prepared to integrate with agent marketplaces

Integrate with agents

Intergrate with MCP server

Connect to marketplaces and the multi-app ecosystem

Logto is launching AI initiatives to give developers tailored solutions