Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Auth has been a wild journey in MCP. It really is a valuable differentiator to things like Skills for enterprises though. Congrats to the team on the ship.
    by lorecore
  • We're always looking at making it a smoother experience - it's a top pain point for developers and IT admins alike. If you have feedback - feel free to send it my way!
    by dend
  • This actually looks like a far better use-case for MCPs than the previous per-user per server MCP design which that was completely rushed and made no sense.

    You can tell with this Anthropic consulted with experts first on the design and implementation of this rather than vibe coding the spec in isolation. Unless the user themselves is compromised and connects via the Enterprise-Managed Authorization, at least you can remotely revoke permissions / access to reduce that risk.

    We'll see, but give credit where credit is due.

    by rvz
  • FWIW, we never vibe-coded the spec to begin with, but yes - auth is a continuous learning process, and we're lucky to collaborate with some really talented folks both inside and outside the company (e.g., this launch we worked closely with Okta to see how we can best wire things up) to make this a smoother experience. Keep the feedback coming!
    by dend
  • I don't quite understand the advantage of this over regular oauth. I think I need an example comparison of the authz flows.
    by RVuRnvbM2e
  • Advantage is user has no control/is not needed to consent about what apps they're authorizing to share their information between each other, bacause the decision to delegate access is at the IdP policy level. User many never know which apps/services were authorized to share their information. Wait, is that an advantage? ;-)
    by megous
  • In regular OAuth, end users consent to share their data with applications individually. This makes sense for consumer usecases, where the end users own their data. But it doesn't make sense for many business usecases, where the business is the entity that should control data sharing and access, not the end user. As an employee at Acme, I shouldn't decide to link my Acme Google Drive data to Claude or ChatGPT, that should be the decision of my IT Department.

    Enterprise-Managed OAuth, or Cross App Access (XAA), brings this IT-Admin centrally controlled sharing model into the OAuth framework so it works with the existing ecosystem.

    There's also a great UX benefit from moving data sharing consent management from employees to IT Admins - it means that employees don't need to sit through a bunch of OAuth flows to link their accounts together. Their IT Admin has already set up all the sharing controls. Everything plugs in together and should Just Work from day one. Think joining a new company on the first day and your Slack is already linked to your Zoom, your Drive, your Calendar, etc...

    by maxwellg
  • MCP auth has been a huge pain point for us at C1 - both for our own internal MCP use and in our in-product MCP Gateway - so very glad to see this landing.

    We launched support today for C1 to act as an EMA identity provider (we mint the short-lived scoped tokens), so I'm excited to hook this up for Linear and some of the other MCPs we use, and get out of the business of constant OAuth flows. Claude has been doing this magically for some of their built-in connectors (at least Slack I think) and the experience is pretty great.

    Disclosure: VPE at C1. We wrote up how we’re approaching it here if anyone’s in the weeds on this: https://www.c1.ai/docs/product/admin/enterprise-managed-auth...

    by russell_h
  • Love more adoption of EMA and, of course, better infra for MCP developers. Thanks for such a quick turnaround on this feature work!
    by dend
  • Read it multiple times, its definitely useful, centralizes the audit and access in one place (with IDP). The IDP can very well act as a proxy API gateway taking care of token exchange when required instead of putting the onus on Client. Thats another approach which has been adopted by some other players in this domain.

    On a personal level, what I felt bit uncomfortable with is this idea of access being delegated on my behalf by IDP to client without making me aware about it. May be I am too used to the concept of user presence in the flows that happens on browser. This it evolving more towards centralizing the access for the machines.

    Given in the enterprise environment the identity really belongs to the company instead of individual, its probably acceptable.

    How its gets incorporated in customer identity is altogether a different challenge. Its probably not possible to have this kind of trust between IDP, client and the resource authorization server.

    by sandeepkd
  • There's theoretically nothing really stopping this integration from working in the consumer space - you just need to establish a trust relationship (e.g., if I am logged in with GitHub, also log me in to Sentry automatically). There is more work ahead here, but as you said - the most obvious _current_ use-case is enterprises, where admins do not want individual employees clicking around picking random credentials they have.
    by dend
  • If only they would support the web and let you just issue a long running cookie....

    I hacked the spec to pass through a cookie via the oauth handshake to do this without needing an oauth server.

    Its really dumb they don't want to allow this.

    If no cookie, open webpage.

    If cookie set, close and persist.

    I literally wrote an 80 page mini book on MCP yet it frustrates me to no end.

    by zackify
  • You're just asking for your credentials to get stolen. Long lived creds are a huge liability.
    by Ferret7446
  • Hey - one of the lead maintainers of the MCP project here. There are a lot of scenarios where this simply won't scale (both from a usability and security standpoint). Cookies were made for the browser. MCP servers and clients often operate in environments where that is not a guarantee.
    by dend
  • Oh wow - seeing my own work in the wild is ... wild. I implemented the RAS end of this for Atlassian. There will certainly be iterations around this flow - CIMD, better tenancy support, etc., but all the folks involved in delivering this at Anthropic, Okta, and here at Atlassian were fantastic.
    by krooj
  • Was great collaborating with you and your team on this!
    by dend
  • This is fantastic. Ive been so fortunate to work with the mcp folks last few months on a couple of the SEPs (and my own experimental sdk in go). I used to be a naysayer. "Its just apis" I used to say. "Sheesh the invented another abstraction" I used to say.

    What folks dont realize is it is the "P" in MCP that throws people off. When you build a traditional app you have to build forms, ui, req/response handling, bidirectional channels, long running tasks, auth and so on.

    With mcp 80% of this common layer is taken care for you. So mcp is really an "app framework" than a protocol (well there is that too).

    Unified auth is a huuuge boost. Can't wait to see more cool things!

    by flashgordon
  • Hey folks - I am one of the folks at Anthropic that helped deliver this in partnership with Okta and a handful of MCP partners. We're very excited about this taking shape in Claude (in addition to the MCP spec, of course, where EMA is now a stable extension) and are looking to expand adoption to other identity providers and clients as well.

    If you have any feedback, feel free to drop it in here! Always happy to hear about folks' experience and how we can make it better.

    by dend
  • Anthropic is the only one with human readable tool names from the JUNE 2025 spec! So you guys are doing a great job and this is another example.

    I'm just curious internally how you are seeing MCP adoption? It seems more and more connectors are created but are you seeing real adoption from users?

    by daniban
  • Great work, thank you for doing this. Just so I understand, this isn't yet available yet, right? Still in SEP stage?
    by brianjking
  • Hiya, congrats on shipping!

    Seems like the main use case is employees of companies. Is there an analogous use case/value for non-centralized users like customers or freemium users?

    I'm struggling to think of one, but wonder what I'm missing.

    Edit: I see you addressed this here: https://news.ycombinator.com/item?id=48594381

    by mooreds
  • Fantastic news. Is there any communication between you folks and the Microsoft Entra (Azure AD) team? Would love to know if we can expect this soon or if will take a while.
    by mikestorrent
  • Long time no see! It's been a while since I've looked at MCP, but I think this does a really good job at making MCP more secure for organizations and addressing some of the weaknesses of dynamic client registration. Now that clients and approved redirect URIs can be setup directly by the IdP and organization, a lot of the attacks that were possible with DCR (confused deputy, phishing attacks, etc.) can be mitigated more broadly. It also makes it so servers don't have to implement as much authorization logic as they did before if the IdP or organization didn't support DCR, which is a pretty big advantage (especially if they combine MCP auth with existing API auth).

    One major downside is consumer usage seems to still need DCR with this. I think this could potentially be addressed by existing consumer OAuth providers (Sign in with GitHub, GitLab, Google, etc.) adding support for registering static MCP clients/servers, clients shipping their static client IDs inside them, clients allowing users to sign in with GitHub/GitLab/whatever IdP, and letting the user self-manage connections on the IdP's site.

    Overall, XAA/EMA seems vastly superior to DCR from a security perspective (and also usability too, since users don't have to configure as much!). The concerns I have are also much easier to address and have way less security impact than with DCR, since attackers don't get to register their own clients anymore and there are less pitfalls for MCP server developers.

    by brianmcnulty
  • This is great for normal "apps". We have a really deep need for a lower touch way for our users to interact with us agentically without setting up MCP. It'd be really great to have some sort of temporary session or out-of-band token storage available.

    Here's our use case: During the sales cycle, the buyer and seller need to exchange a bunch of information then analyze it (which is increasingly agentic). The problem with MCP is the initial setup friction is far greater than users login in themselves and grabbing the information they need. MCPs are great for regular, frequent interactions - but create a lot of problems for these quick one-off sessions.

    We'd really love a way to do something like this:

    * In Claude: "Grab documents from X, Y, Z"

    * Claude hits that website, it returns (1) basic usage information (2) a login link that the user can open in their browser

    * User auths in their browser (annoying, but mindless)

    * That callback returns a unique, short-lived, one-time token that gets exchanged on all future requests to the site.

    Now, we can quickly auth users AND maintain a session state as they do things.

    by SkyPuncher
  • I am currently trying to use Microsoft Entra ID auth for an MCP server I'm implementing, and I genuinely feel like I must be an idiot.

    - I can use the `WWW-Authenticate` header to indicate a resource metadata URL for the client.

    - I can use this to indicate an authorization server (Microsoft Entra) and a scope (for the app registration that handle which app roles each user is given to differentiate different capabilities for different users).

    - I can NOT indicate a client_id, because that's just something that each client (agent) makes up on its own?

    - To initiate a login on the .../authorize URL in Microsoft Entra, you need to pass a known client_id that matches an app registration in Microsoft Entra. Whatever the client makes up will surely not match anything in Microsoft Entra.

    - I COULD in theory support dynamic client registration, but of course Microsoft Entra doesn't.

    Is it even possible to make this work out of the box? The only way forward I can see is implementing my own dynamic client registration shim in front of Microsoft Entra that just returns the same static client_id to everyone, which matches an actual client_id in Microsoft Entra.

    But surely this protocol actually works today for real Enterprises without workarounds? It feels like I must be missing something obvious.

    by programmancer
  • Yeah, I recently documented how to use pre-registered clients with FusionAuth[0] (my employer). DCR's newer, better sibling CIMD is on our radar and under active discussion[1], but not currently available.

    An alternative to the proxy you suggest is to generate a new Entra client id (with PKCE enabled) for every MCP client in a developer portal or similar, then have the user configure their client with that client id. Here's the CLI command I found to do this[2], but I bet there's an API too. Here are config instructions for Claude Code[3] and ChatGPT[4].

    Client pre-registration is acceptable, but not optimal, for developers, and is a first class citizen in the spec[5]. If your main audience is internal and you can expect them to follow configuration instructions to get access to the MCP server, this approach can work.

    But it's definitely not acceptable for widespread, public integrations if your audience is not developers. That is where a lot of the power and opportunity for MCP lies.

    0: https://fusionauth.io/docs/extend/examples/controlling-acces...

    1: https://github.com/FusionAuth/fusionauth-issues/issues/3230

    2: https://learn.microsoft.com/en-us/cli/azure/ad/app?view=azur...

    3: https://code.claude.com/docs/en/mcp

    4: https://developers.openai.com/api/docs/guides/developer-mode

    5: https://modelcontextprotocol.io/specification/2025-11-25/bas...

    by mooreds
  • I actually implemented this yesterday. The gist is this library runs the MCP server: https://csharp.sdk.modelcontextprotocol.io/concepts/identity...

    Then I build an authbroker application using openid to handle client registration and build the jwt. End result is something that can determine tool availability and permission using an employees department, or other criteria.

    So yeah the dynamic client registration is needed.

    by dalenw
  • We had the same issue with the client_id and for security reason we weren't willing to enable DCR.

    What we ended up doing, was the app proxying the OAuth flow, to inject a hardcoded client_id. So we lie to the MCP client telling it we support DCR while behind the hood we use a standalone client_id as usual for the MCP.

    If you want to take example at it https://gist.github.com/erebe/a5de36d42214721b2466fb0e66f61c...

    by erebe__
  • I don't think you are missing anything obvious. Entra ID doesn't support DCR, and the state of the ecosystem here is suboptimal.

    The typical way to do MCP OAuth is with traditional up-front registered clients. However, in practice a lot of MCP clients work with an assumption that DCR works, and as you point out don't offer an option to specify a client ID.

    However, some clients do support that (ad: our tool Erato does[0]), and the typical solutions deployed in enterprises do, where MCP access is usually centralized via a web UI like ours. One alternative that also exists is are MCP gateways, which do pre-registred oauth between the gateway and service, and allow for DCR between the gateway and clients.

    [0]: https://erato.chat/docs

    by hobofan
  • Huge congrats to the folks behind this at Okta, A\, Microsoft, Figma, Linear, etc...

    For the MCP nay-sayers - don't worry there's something here for you too :)

    This is powered by a new token format called an ID-JAG - https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-a... - and isn't MCP specific at all. ID-JAGs can be used for safe and secure data sharing anywhere where data is shared between applications that use the same SSO provider.

    by maxwellg