Skip to main content

Core concepts

A Virtual MCP server bundles multiple connectors into one endpoint, so users connect once instead of configuring each server individually.

The problem without MintMCP​

Traditional MCP deployment means each user installs and configures servers separately. With Slack, Google Drive, and a database connector, that's three installations, three auth flows, and three points of failure per user.

It also creates management headaches:

  • Each server handles its own authentication
  • Security policies are configured per endpoint
  • No central visibility into usage
  • Hard to share curated tool sets with teams

How it works​

Users connect to a single Virtual MCP endpoint that:

  1. Authenticates through your identity provider
  2. Enforces policies based on roles and permissions
  3. Routes requests to the right connectors
  4. Logs everything for audit and analytics

Architecture​

AI clients connect to Virtual MCPs, which look like normal MCP endpoints. Behind the scenes, MintMCP routes requests to the right connector with the right credentials, and logs everything.

Request flow​

The client always authenticates with OAuth. How MintMCP authenticates to connectors varies, but clients don't need to know.

Client authentication​

Virtual MCP servers expose a unified OAuth 2.0 interface to all AI clients. For deeper coverage of MintMCP OAuth, SSO integrations, and connector credential options, see the authentication models guide.

When a client connects to a Virtual MCP server:

  1. Client initiates OAuth flow with the Virtual MCP server
  2. User authenticates through MintMCP (which can delegate to your organization's SSO)
  3. Virtual MCP server validates permissions and issues access tokens
  4. Client uses these tokens for all subsequent requests

This unified approach provides several benefits:

  • Consistency: Every AI client authenticates the same way
  • Simplicity: Clients don't need to handle multiple authentication methods
  • Security: MintMCP manages token lifecycle and rotation
  • Flexibility: Underlying connectors can use different auth methods without affecting clients

Connector authentication strategies​

While clients always authenticate to Virtual MCP servers using OAuth, the Virtual MCP server itself can authenticate to underlying MCP connectors in different ways. This separation of concerns is key to the architecture's flexibility.

Benefits​

Virtual MCP servers fundamentally change how organizations deploy AI tools:

For administrators:

  • Deploy once, share with entire teams and organizations
  • Centralized access control and audit logs
  • Simplified credential management
  • Consistent security policies

For end users:

  • Single sign-on experience
  • Access to curated tool sets for particular roles
  • No complex setup procedures
  • Consistent interface across all tools

For organizations:

  • Reduced support burden
  • Improved compliance posture
  • Better visibility into AI tool usage
  • Faster rollout of new capabilities

Next steps​