Repository navigation
Implement SEP-990: Enterprise Managed Authorization (Extension) #531
Description
This is a tracking issue for implementation of SEP-990.
Summary
This extension enables secure authorization of MCP clients within enterprise environments by leveraging existing enterprise Identity Provider (IdP) infrastructure. The Rust SDK needs to implement client-side OAuth flows including OpenID Connect/SAML integration, RFC8693 Token Exchange to obtain Identity Assertion JWT Authorization Grants (ID-JAG), and RFC7523 JWT Bearer Grant flows. Server-side implementations need JWT validation including signature verification, claims validation, and replay prevention. This extension provides seamless single sign-on for users while enabling enterprise administrators to control which MCP servers can be accessed and enforce policies through existing IdP infrastructure.
Related Issues & PRs
- Implementation PRs: n/a
- Related PRs: n/a
- Related Issues: n/a
Activity
tanish111 commentedon Dec 11, 2025
@alexhancock @jokemanfire is anyone working on this?
If not can I start working ?
tanish111 commentedon Dec 16, 2025
anyone working on this?
alexhancock commentedon Dec 16, 2025
@tanish111 Not yet to my knowledge
tanish111 commentedon Dec 16, 2025
In that case, I’ll start working on it. I think it’s related to my recent OAuth CIMD change.
hobofan commentedon Jun 19, 2026
The extension spec has just been stabilized: https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/
tdesai-eightfold commentedon Jun 19, 2026
@hobofan Thanks for the update. I’ll estimate the implementation effort and get back to you.
github-actions commentedon Aug 19, 2026
This issue has had no activity for 60 days and is now marked as stale. It will be closed in 14 days if there is no further activity. Add the
keeplabel to keep it open.github-actions commentedon Sep 2, 2026
Closing this issue after 14 days of inactivity since it was marked stale. Feel free to reopen if it is still relevant.
feat(auth): exchange ID-JAGs for MCP access tokens
feat(auth): add enterprise refresh-token and ID-JAG exchanges (#1234)