> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usechar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise SSO for MCP

> How Char extends enterprise identity to internal MCP tool access

Char extends your existing enterprise SSO to internal MCP tool execution.

## Flow overview

```mermaid theme={null}
sequenceDiagram
    participant App as Your Application
    participant IDP as Your IDP
    participant Agent as Embedded Agent
    participant Hub as Tool Hub
    participant MCP as Internal MCP Server

    App->>IDP: User authenticates
    IDP-->>App: ID Token
    App->>Agent: connect({ publishableKey, idToken })
    Agent->>Hub: Authenticated session
    Hub->>IDP: Token exchange for MCP target
    IDP-->>Hub: Scoped token/assertion
    Hub->>MCP: tools/call with scoped credential
    MCP-->>Hub: Result
    Hub-->>Agent: Result
```

## Why this model

* User-scoped identity instead of shared service-account credentials
* Policy can be enforced centrally at org/IDP boundaries
* Access can be revoked through existing identity controls

## Prerequisites

* Publishable-key embed integration
* IDP configured in Char for `idToken` validation
* Remote MCP beta setup for token exchange and connector registration

## Related docs

<CardGroup cols={2}>
  <Card title="Internal MCP Servers" icon="server" href="/guides/internal-mcp-servers" />

  <Card title="Identity Providers" icon="shield" href="/identity-providers/index" />
</CardGroup>