Testing SSO With an AI Agent: Driving a Mock IdP Over MCP

mock-idp is a free, MIT-licensed SSO testing tool from SSOJet that simulates major identity providers and exposes its API through a Streamable HTTP MCP endpoint, allowing AI agents such as Claude Code to create tenants, configure SAML, OIDC, and SCIM applications, generate users, inject authentication faults, perform headless sign-ins, and inspect decoded logs. Its 39 MCP tools support exploratory negative testing of issues such as expired assertions, missing claims, invalid audiences, forged signatures, and XML Signature Wrapping attacks; an example shows an agent creating an Entra tenant, enabling a one-time signature-wrapping fault, submitting a SAML response, and confirming that the bundled test service provider rejected an unsigned attacker-controlled assertion before a subsequent normal login succeeded. The tool can also be pointed at an organization’s own application to evaluate what it accepts or rejects, although agent findings should be converted into fixed, assertion-based CI tests rather than treated as authoritative results. Security measures include Origin validation to prevent cross-site localhost requests, host validation against DNS rebinding, optional bearer-token authentication through `MOCKIDP_API_TOKEN`, and guidance to keep production credentials and production systems separate from the test environment.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.