Today we’re launching two major improvements to the SailPoint MCP Server that make it much easier to connect AI assistants to Identity Security Cloud: a global URL and OAuth authentication with PKCE.
What’s New
Global MCP URL
Previously, connecting an AI client to SailPoint required knowing your tenant-specific URL (https://[your-org].api.identitynow.com/v2025/access-requests/mcp). This meant every user needed to know their exact org name and construct the right URL before they could get started.
Now, there’s a single global endpoint that works for every tenant (excluding FedRAMP and data sovereignty tenants):
https://mcp.api.cloud.sailpoint.com/latest/access-requests/mcp
Your tenant is automatically identified during authentication — no tenant-specific URL needed.
OAuth with PKCE
We’ve replaced the manual token workflow with an OAuth 2.1 flow using PKCE. When you connect your AI client:
- A browser window opens
- You log in with your ISC credentials (including SSO if configured)
- You approve a consent screen
- You’re connected — tokens refresh automatically for up to a month (No more expired credentials mid-session).
Cursor IDE Support
Cursor now works natively with the SailPoint MCP Server. Add the URL and your Client ID to ~/.cursor/mcp.json, click Connect, and the OAuth flow is handled automatically from there.
Why This Matters
The MCP Server lets your AI assistant manage access requests through natural conversation:
- “What roles can I request?” — searches the access catalog
- “Request the Sales Analytics role for me” — submits the request with proper formatting
- “What’s the status of my pending requests?” — checks approval state
- “Cancel my request for the Finance entitlement” — cancels with a comment
With the global URL, getting started takes minutes instead of a configuration adventure — just add the URL, connect, and you’re up and running.
Getting Started
Prerequisites
- An ISC tenant with the SailPoint MCP enabled
- Cursor (v0.44+) or Claude Desktop installed
For Cursor Users
- Create an API Client in ISC (Admin > Security Settings > API Management):
- Set as Public, enable Authorization Code + Refresh Token grants
- Redirect URL:
cursor://anysphere.cursor-mcp/oauth/callback - Scope:
sp:scopes:all
- Add to
~/.cursor/mcp.json:
"mcpServers": {
"sailpoint-access-requests": {
"url": "https://mcp.api.cloud.sailpoint.com/latest/access-requests/mcp",
"auth": {
"CLIENT_ID": "your-client-id",
"scopes": ["sp:scopes:all"]
}
}
}
}
- Connect in Cursor Settings > MCP, log in, and approve access.
That’s it. Start asking your AI agent about access requests. Refer to MCP Authorization specification for more MCP authorization details.
What About Existing Setups?
Existing tenant-specific URLs continue to work unchanged. The global URL is additive — it’s a new, simpler path that we recommend for new integrations.
If you’re currently using a PAT-based setup, you can migrate at your pace. The global URL with OAuth provides better security (scoped tokens, automatic refresh, user consent) and better UX (no manual token management).
Note: Global URL access is not available for FedRAMP tenants or tenants with data sovereignty requirements. These environments should continue using tenant-specific URLs.
What’s Next
This release focuses on access requests, but the global URL infrastructure supports future MCP servers as we expand SailPoint’s AI integration surface. Stay tuned for additional capabilities.
Resources
We’d love to hear how you’re using the MCP Server. Share your experience on the Developer Forum or reach out to your SailPoint customer support manager.
Known Limitations & FAQ
What’s NOT Included
- FedRAMP tenants — they continue using tenant-specific URLs only
- Data sovereignty tenants — global URL access is blocked
- Dynamic client registration — coming soon
Q: Does this break existing tenant-specific setups?
A: No. All existing URLs and PAT-based flows continue to work unchanged.
Q: How often does the user need to re-authenticate?
A: Refresh tokens can be configured during client ID creation. Consent is re-prompted every 24 hours on reconnect.
Q: What if the user has access to multiple tenants?
A: They’ll be prompted to enter their tenant on first connect. The selection is cached for 1 week via cookie.
