Most teams connect an AI agent to an internal system with one service account. Then every employee who asks the agent can see everything that account can see. The system's log shows one user for everyone.
On xpander, a shared agent calls your MCP server as the person who asks. Your server applies that person's permissions. We tested it on a self-hosted xpander install running the agent on Claude Code. Alice and Bob asked the same agent "What equipment do I have?" Alice got her 3 items. Bob got his 3 items. No item was in both answers. When Alice asked for Bob's items, the inventory server refused.
Real screenshots from the Acme install. Names shown in place of test labels.
Why this is hard
An MCP server is the standard way to give an AI agent access to an internal system. The hard part is whose access the agent uses.
A shared service account can see everything. So every person who asks the agent can see everyone's data.
A personal sign-in on a laptop works for one person. AI coding agents such as Claude Code already do this. It does not work for one agent that many people share.
A token tool such as Arcade or Aembit can give an agent each person's token. You still have to run the agent, share it with your teams and govern it. Cloud agent services do this only for agents you write, on their own cloud.
How it works on xpander
Each person signs in once. The first time a request needs the MCP server, the chat shows a sign-in card. If the person already signed in to xpander through the same identity provider, they do not type a password.
xpander keeps each person's token. It stores the token, refreshes it, and adds it to each call at run time. The agent never sees it.
Your MCP server decides. It reads the person from the token and returns only what that person may see.
Bob's first request after he disconnected Acme Inventory.
What we ran
A self-hosted xpander install for a sample company, Acme, with its own Keycloak.
One shared agent, "Acme IT Assistant", on Claude Code with Opus 5.5.
One MCP server, "Acme Inventory", that checks each token.
Two employees: Alice (Engineering) and Bob (Design).
The proof: the agent sends no name
Here are the two tool calls from the run log. Both calls have the same empty input: {}. The agent did not tell the server who was asking. The server still returned Alice's items to Alice and Bob's items to Bob. Our server reads the person from the token. The agent sent nothing.
Values copied from the run log. Item lists are shortened.
The refusal comes from your server
Alice then asked the agent to look up Bob's items. The agent sent Bob's email to the inventory server. The server refused and named Alice as the person who asked. The agent did not make that choice. Your server did.
Values copied from the run log for Alice's third request.
What this does not cover
This page is about calls to your systems. Two other paths also matter:
Conversations. On xpander, a conversation is a work session, not a security boundary. People who can use the same agent can open a conversation if they have its link. So the per-person check lives in your systems.
The agent's computer. One agent has one computer for all its conversations. Each conversation gets its own folder, but all conversations run as the same user on that computer. So a file the agent saves in one conversation can be reached from another. Do not ask the agent to save sensitive tool results to files.
What you build
This is not one switch. Here is the real setup, from the docs:
Turn on MCP sign-in on your self-hosted install. Set
CLIENT_AUTH_EXTERNAL_URLin your Helm values.Create a client in your identity provider: confidential, authorization code flow, with the
offline_accessscope.Make your MCP server check the token. Publish your identity provider's endpoints, answer a missing token with
401, and read the person from each token. The docs include a short Python sample for Keycloak.Register the MCP server for the organization, with OAuth2.
Attach it to a shared agent and give the agent access for the whole organization.
After that, people sign in once, and xpander keeps their tokens fresh.
Try it
Read the full setup in Per-person sign-in for MCP connectors. To see it on your own systems, book a demo.
