- Status: Final
- Type: Standards Track
- Created: 2025-06-04
- Author(s): Aaron Parecki (@aaronpk)
- PR: #646
- Issue: #990
Abstract
This extension is designed to facilitate secure and interoperable authorization of MCP clients within corporate environments, leveraging existing enterprise identity infrastructure.
- For end users, this removes the need to manually connect and authorize the MCP Client to individual services within the organization.
- For enterprise admins, this enables visibility and control over which MCP Servers are able to be used within the organization.
How Has This Been Tested?
We have an end to end implementation of this here, and in-progress MCP implementations with some partners.
Breaking Changes
This is designed to augment the existing OAuth profile by providing an alternative when used under an enterprise IdP. MCP clients can opt in to this profile when necessary.
Additional Context
For more background on this problem, you can refer to my blog post about this here:
I also presented this at the MCP Dev Summit in May.
A high level overview of the flow is below:
[!IMPORTANT] State: Ready to Review