MCP Service

Added in version 3.0.0

The Model Context Protocol (MCP) Service enables AI agents and applications to securely access, manage, and interact with personal data stored in ESS. The service uses ESS Access Tokens directly for authentication, providing a simple integration path for enterprise AI applications.

MCP Resource Service

The MCP Resource Service provides MCP tools, such as requestAccess and getResource, that enable AI agents and applications to interact with personal data in ESS, given the appropriate access by the user.

Clients authenticate using an ESS Access Token obtained via the Platform Management service.

Security Model

The MCP Service uses a layered security approach:

1. ESS Access Tokens: Clients authenticate using ESS Access Tokens obtained through the standard Token Exchange flow

2. Access Grants: Access to resources is mediated through Access Grants, which are W3C Verifiable Credentials

3. Delegator Scoping: Operations are scoped to the authenticated end user (delegator), preventing agents from exceeding the current user's access rights

Use Cases

AI Agent Resource Access

An AI agent needs to review a user's financial data in order to provide them with a loan estimate.

Flow:

1. Agent authenticates with the external IdP and exchanges for an ESS Access Token

2. Agent uses the requestAccess tool to create an Access Request for the user's bank statements

3. User reviews and approves the Access Request

4. Agent uses checkAccessRequestStatus to detect approval

5. Agent uses hasMatchingAccessGrant to verify the grant

6. Agent uses getResource to retrieve the bank statements

Automated Data Processing

An automated service processes user data on a schedule:

1. Service authenticates and obtains an ESS Access Token

2. Service checks for existing access grants using hasMatchingAccessGrant

3. If grant exists, service retrieves and processes the data

4. Service logs all operations for audit purposes

Getting Started

To enable the MCP Service in your ESS deployment:

1. Configure the Platform Management service: Set up trusted Identity Providers

2. Configure the MCP Resource Service: Connect to the Access Grant service and Storage service

3. Obtain an ESS Access Token: Authenticate with your IdP and exchange the token

4. Test the Integration: Use the MCP Resource Service tools to verify access

For detailed configuration instructions, see:

• MCP Resource Service Configuration

• Platform Management service

Additional Information

• Model Context Protocol: MCP Specification

• Access Grant Service: ESS Access Grant Service

• Token Exchange: Platform Management service

• Integration Guide: Integrating an AI Agent with ESS using MCP