EZGH apps and MCP clients

EZGH products with end users get them from EZGH SSO: your directory’s people sign in at your portal, and IAM decides what they may do in the product. The first will be MCP Central, EZGH’s MCP gateway.

EZGH applications

An ezgh application is a portal tile for an EZGH product, and the settings for that product’s tokens:

{
  "name": "MCP Central",
  "kind": "ezgh",
  "ezgh": { "product": "mcpcentral", "launchUrl": "https://mcpcentral.ezghcloud.com/", "resourceTokenLifetimeSeconds": 3600 }
}

The console application, with product console, has its own settings: see Console access.

The tile shows the product’s own mark, or a logo you upload instead.

Assign users and groups to choose who sees the tile. Assignments don’t give access to the product: what a directory user may do in an EZGH product comes from IAM policies attached to them or their groups. See Access control.

MCP clients

MCP clients, such as Claude Code, sign in to EZGH products through your directory: it’s the only place an interactive MCP client signs in to EZGH Cloud. The client finds your directory’s issuer from the product (once MCP Central launches), then runs OAuth at https://<alias>.sso.ezgh.app:

1. The client identifies itself with a client ID metadata document (its client_id is an https URL of its metadata), or registers at /oauth2/register (RFC 7591: public clients only, no secret; limited to 20 registrations an hour per IP address).
2. It asks for one resource: authorization code with PKCE (S256), scope mcpcentral:connect, and resource (RFC 8707), the URL of what it connects to, such as your organization’s MCP Central endpoint.
3. The person signs in at your portal if they aren’t already, and approves on a consent page that names the client, where it returns and the resource. They’re asked every time.
4. The client gets an EZGH resource token (ezgh_sat_…, opaque) for that resource only, and a refresh token. Both are used like any credential, and checked by IAM on every request.

Signing out of the portal doesn’t end an MCP client’s access. Suspending, deleting or resetting the user’s factors does, and so does RevokeSessions for that user. The client can revoke its own tokens at /oauth2/revoke.