What happened
On Oct 15 Descope released Agentic Identity Hub 3.0 targeting internal 'shadow AI': an Agent Onboarding Portal (self-service catalog, reviewer sign-off, scoped access per agent/MCP server), native integration with MCP gateways including the open-source agentgateway, short-lived private-key signed client assertions replacing static secrets, and single-sign-on-style access to MCP servers with policy evaluated every request.
Why it matters
Directly addresses the shadow-AI problem (45% of employees use AI on corporate devices, ~2/3 with personal accounts per Verizon DBIR) and static-secret leakage — the two biggest identity gaps for internal agents. Version 3.0 extends governance to agents that orgs don't instrument (Claude, Cursor, third-party MCP), giving security teams a policy/audit point where none existed.
Applicability
Identity and security teams at enterprises adopting internal/employee-built agents and MCP servers should evaluate Hub 3.0 for onboarding, credential hygiene, and a single identity/policy layer over non-instrumentable agents.