> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/3.1/services/service-mcp.md).

# MCP Service

{% hint style="success" %}
Added in version 3.0.0
{% endhint %}

The Model Context Protocol (MCP) Service enables AI agents and applications to securely access, manage, and interact with personal data stored in ESS. The service uses ESS Access Tokens directly for authentication, providing a simple integration path for enterprise AI applications.

## MCP Resource Service

The [MCP Resource Service](/ess/3.1/services/service-mcp/mcp-resource.md) provides MCP tools, such as `requestAccess` and `getResource`, that enable AI agents and applications to interact with personal data in ESS, given the appropriate access by the user.

Clients authenticate using an ESS Access Token obtained via the [Platform Management service](/ess/3.1/services/service-platform-management/token-exchange.md).

## Security Model

The MCP Service uses a layered security approach:

1. **ESS Access Tokens**: Clients authenticate using ESS Access Tokens obtained through the standard [Token Exchange](/ess/3.1/services/service-platform-management/token-exchange.md) flow
2. **Access Grants**: Access to resources is mediated through Access Grants, which are W3C Verifiable Credentials
3. **Delegator Scoping**: Operations are scoped to the authenticated end user (delegator), preventing agents from exceeding the current user's access rights

## Use Cases

### AI Agent Resource Access

An AI agent needs to review a user's financial data in order to provide them with a loan estimate.

Flow:

1. Agent authenticates with the external IdP and exchanges for an ESS Access Token
2. Agent uses the `requestAccess` tool to create an Access Request for the user's bank statements
3. User reviews and approves the Access Request
4. Agent uses `checkAccessRequestStatus` to detect approval
5. Agent uses `hasMatchingAccessGrant` to verify the grant
6. Agent uses `getResource` to retrieve the bank statements

### Automated Data Processing

An automated service processes user data on a schedule:

1. Service authenticates and obtains an ESS Access Token
2. Service checks for existing access grants using `hasMatchingAccessGrant`
3. If grant exists, service retrieves and processes the data
4. Service logs all operations for audit purposes

## Getting Started

To enable the MCP Service in your ESS deployment:

1. **Configure the Platform Management service**: Set up trusted Identity Providers
2. **Configure the MCP Resource Service**: Connect to the Access Grant service and Storage service
3. **Obtain an ESS Access Token**: Authenticate with your IdP and exchange the token
4. **Test the Integration**: Use the MCP Resource Service tools to verify access

For detailed configuration instructions, see:

* [MCP Resource Service Configuration](/ess/3.1/services/service-mcp/mcp-resource.md#configuration)
* [Platform Management service](/ess/3.1/services/service-platform-management/token-exchange.md)

## Additional Information

* **Model Context Protocol**: [MCP Specification](https://modelcontextprotocol.io/)
* **Access Grant Service**: [ESS Access Grant Service](/ess/3.1/services/service-access-grant.md)
* **Token Exchange**: [Platform Management service](/ess/3.1/services/service-platform-management/token-exchange.md)
* **Integration Guide**: [Integrating an AI Agent with ESS using MCP](https://github.com/inrupt/docs-gitbook/tree/main/ess/guides/integrating-with-ess-mcp.md)