# Authenticate with MCP

Aikido Pentest signs in to a remote Model Context Protocol (MCP) server with a bearer token. On the **Test Users** step, add an **MCP** test user and provide the endpoint and the token.

## Prerequisites

* The MCP endpoint URL, including the `/mcp` path clients connect to.
* A bearer token that stays valid for the whole assessment.

## Set up MCP authentication

{% stepper %}
{% step %}
### Select Web Application

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On **Select Pentest Target**, select **Web Application**.
{% endstep %}

{% step %}
### Add an MCP test user

In the assessment wizard, on the **Test Users** step, click **Add Test User** → **MCP**.
{% endstep %}

{% step %}
### Enter the endpoint URL

In **URL**, enter the MCP endpoint. Aikido prefills this from the scope URL. End the URL with `/mcp`.

Example: `https://mcp.staging.example.com/mcp`

{% hint style="info" %}
A URL that stops at the host still authenticates. The agent spends extra time discovering the endpoint, so include `/mcp`.
{% endhint %}
{% endstep %}

{% step %}
### Enter the bearer token

In **Bearer Token**, paste the token value. Aikido sends it as `Authorization: Bearer <token>`.

Issue a token that stays valid for the full pentest. 24 hours is a good lifetime, and it is usually the default.

{% hint style="info" %}
This method sends `Authorization: Bearer`. For a different header, use **API Key** on the **Test Users** step.
{% endhint %}
{% endstep %}

{% step %}
### Save and test

Keep the default **Authentication instructions** unless the server needs extra steps. Click **Save & Test**. Aikido initializes the MCP server and checks that the handshake returns a successful result.

<figure><img src="https://help.aikidogov.us/_assets/f8b27c7e6515/authenticate-with-mcp.png" alt="Authenticate with MCP modal with the endpoint URL filled in and the bearer token field showing its placeholder"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Related

{% content-ref url="../testing-mcp-servers.md" %}
[Testing MCP Servers](https://help.aikidogov.us/pentests/configure-a-pentest/testing-mcp-servers)
{% endcontent-ref %}