# Try It Out

Each walkthrough below runs the [Securing MCP](https://thunderid.dev/docs/use-cases/ai-agents/overview.md) pattern against the Wayfinder sample. The Wayfinder Server hosts an MCP server on `/mcp` alongside its REST API; an external MCP client signs in through ThunderID and calls Wayfinder's tools.

The sample supports two MCP tool authorization modes:

- **Scope-based MCP authorization** checks the permissions already present in the incoming access token.
- **AuthZEN-based MCP authorization** validates the incoming token, then asks the ThunderID policy decision point (PDP) for a runtime allow or deny decision before invoking protected tool handlers.

## Meet Wayfinder

Wayfinder is the same travel-booking application from the [Securing AI Agents tryout](https://thunderid.dev/docs/use-cases/try-it-out.md), where the in-product **Wayfinder Concierge** acts as an MCP client from inside the app. This tryout covers the other side: an **external** MCP client connecting to the same Wayfinder MCP server through its own OAuth application in ThunderID. The application is pre-registered in the bundle; in production, clients that support [Dynamic Client Registration](https://thunderid.dev/guides/protocols/oauth-oidc/dynamic-client-registration.md) can self-register at runtime instead.

### Meet the Cast

- **John Doe** signs in to the external MCP client and picks which `booking:*` permissions to grant at consent. He carries the `Booking User` role with read, create, and cancel permissions.
- **MCP Inspector** is the [reference debug UI](https://github.com/modelcontextprotocol/inspector) for MCP servers. It runs in the browser, speaks the protocol, and supports OAuth-protected servers out of the box.

## Sample Architecture

This tryout extends the AI Agents architecture with one new piece:

- **External MCP Client**: an OAuth client (MCP Inspector) that signs in through ThunderID and calls the Wayfinder MCP server's tools.

The Wayfinder Server validates the issued access token on every MCP call. The server enforces the per-tool scope before invoking protected tool handlers.

## Set Up Your Environment

Complete the [AI Agents Set Up Your Environment](https://thunderid.dev/docs/use-cases/try-it-out/setup.md) first. The same bundle also seeds the `EXTERNAL-MCP-CLIENT` application used here.

### Verify the New Application

In the ThunderID Console at https://localhost:8090/console, open **Applications** and confirm `EXTERNAL-MCP-CLIENT` is listed.

### Install MCP Inspector

Launch MCP Inspector locally:

```bash
npx @modelcontextprotocol/inspector
```

### Allow Inspector in CORS

Add Inspector's origin to the server-config `cors` section. Create or update `config/resources/server_configs/cors.yaml`, or use `PUT /server-config/cors` after startup:

```yaml
name: cors
value:
  allowedOrigins:
    # ...existing entries...
    - "http://localhost:6274"
```

## Walkthroughs

Pick a walkthrough to begin. Each one starts from the setup above.

- [Scope-Based MCP Authorization](https://thunderid.dev/docs/use-cases/ai-agents/mcp-authorization/connect-via-inspector.md), Authorize an external MCP client, list Wayfinder's tools, call a few, and watch scope enforcement deny the booking deletion tool.

- [AuthZEN-Based MCP Authorization](https://thunderid.dev/docs/use-cases/ai-agents/mcp-authorization/authzen-authorization.md), Enable AuthZEN mode and watch the Wayfinder MCP server ask the PDP for runtime tool decisions.

## Going Deeper

- Curious how the MCP-specific application and consent step map to ThunderID concepts? See [Identity Concepts](https://thunderid.dev/docs/use-cases/ai-agents/identity-concepts.md).
- Prefer to register the application manually? See [Configure It Yourself](https://thunderid.dev/docs/use-cases/ai-agents/configure-it-yourself.md).
- Want to compare server-side and client-side patterns before going to production? See [Solution Patterns](https://thunderid.dev/docs/use-cases/ai-agents/solution-patterns.md).
- Ready to apply this to your own MCP server instead of the Wayfinder sample? See the [MCP Authorization guides](https://thunderid.dev/guides/mcp/overview.md).