MCP with Federated Auth

Transform existing private enterprise APIs into LLM-ready MCP tools without hand-coding each tool wrapper. Add the API definition and authentication mapping, then validate the generated schema, authorization behavior, and network reachability before deployment.

Supported Import Methods

Add your existing APIs to DeepIntShield using any of these methods:

Postman Collection

Import your existing Postman collections directly into DeepIntShield. All request configurations, headers, and parameters are preserved.

{
  "info": {
    "name": "Enterprise API Collection",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "Get User Profile",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Authorization",
            "value": "{{req.header.authorization}}",
            "type": "text"
          }
        ],
        "url": {
          "raw": "https://api.company.com/users/profile",
          "host": ["api", "company", "com"],
          "path": ["users", "profile"]
        }
      }
    }
  ]
}

OpenAPI Spec

Use your existing OpenAPI 3.0+ specifications. DeepIntShield automatically converts them into MCP-compatible tools.

openapi: 3.0.0
info:
  title: Enterprise API
  version: 1.0.0
paths:
  /users/profile:
    get:
      summary: Get user profile
      security:
        - BearerAuth: []
      parameters:
        - name: Authorization
          in: header
          schema:
            type: string
          example: "{{req.header.authorization}}"
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer

cURL Commands

Convert your existing cURL commands directly into MCP tools.

curl -X GET "https://api.company.com/users/profile" \
  -H "Authorization: {{req.header.authorization}}" \
  -H "Content-Type: application/json"

Built-in UI

Use DeepIntShield’s intuitive UI to manually configure your API endpoints with the same ease as Postman.

1. Set HTTP method and URL
2. Configure headers with variable substitution
3. Define request body (if needed)
4. Test the endpoint
5. Deploy as MCP tool

What Happens Next

Once you upload your API specifications, DeepIntShield automatically:

• Syncs authentication systems from your existing APIs
• Converts endpoints into MCP-compatible tools
• Maintains security using your current auth infrastructure
• Makes validated APIs available to LLMs after configuration and deployment

Supported Authentication Types

DeepIntShield automatically handles all common authentication patterns:

• Bearer Tokens (JWT, OAuth)
• API Keys (headers, query parameters)
• Custom Headers (tenant IDs, user tokens)
• Basic Auth and other standard methods

Real-World Use Cases

Enterprise CRM Integration

Transform your Salesforce, HubSpot, or custom CRM APIs:

{
  "name": "Get Customer Data",
  "method": "GET",
  "url": "https://api.company.com/crm/customers/{{req.body.customer_id}}",
  "headers": {
    "Authorization": "{{req.header.authorization}}",
    "X-Tenant-ID": "{{req.header.x-tenant-id}}"
  }
}

Internal Microservices

Make your internal microservices LLM-accessible:

paths:
  /internal/user-service/profile:
    get:
      parameters:
        - name: Authorization
          in: header
          schema:
            type: string
            default: "{{req.header.authorization}}"
        - name: X-Service-Token
          in: header
          schema:
            type: string
            default: "{{env.INTERNAL_SERVICE_TOKEN}}"

Database APIs

Connect to your database APIs securely:

POST https://db-api.company.com/query
Content-Type: application/json
Authorization: {{req.header.authorization}}
X-Database-Name: {{req.header.x-database}}

{
  "query": "SELECT * FROM users WHERE tenant_id = '{{req.body.tenant_id}}'",
  "limit": 100
}

Security Benefits

1. Zero Trust Architecture

• Authentication happens at the edge (your existing systems)
• Delegated X-MCP-Subject-Token values are redacted and never persisted; exchanged resource tokens live only in a bounded process-local session pool
• Shared MCP headers, OAuth client configuration, and OAuth tokens can be persisted. Configure one stable DEEPINTSHIELD_ENCRYPTION_KEY to encrypt those values at rest; without it, literal values remain plaintext
• When canonical GAF is enabled, every MCP invocation is independently authorized even when an upstream OAuth transport session is reused

2. Existing Security Policies

• Leverage your current RBAC (Role-Based Access Control)
• Maintain existing audit trails
• No changes to security infrastructure required

3. Granular Access Control

• Different users get different API access based on their credentials
• Tenant isolation maintained through existing headers
• API rate limiting and quotas preserved

4. Compliance Friendly

• Delegated caller tokens are not persisted; explicitly configured shared credentials follow the storage and encryption rules above
• Existing compliance frameworks remain intact
• Audit trails maintained in your systems