Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-Touch OAuth for MCP

blog.modelcontextprotocol.io

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Zero-Touch OAuth for MCP

#81

Post by 9dev »

sean_lynch wrote: post #14

Before you get too far into the usual “MCP is dead, Skills forever” debate The real valuable capability MCP offers over skills/CLI is isolating the auth flow outside of the agent’s context window, and potentially out of the harness completely. This is valuable from a security perspective obviously. It’s also just a much easier user experience for normies and large businesses adopting AI tools. I hear all the context…

Aside from that, MCPs also allow connecting an external platform without a runtime environment. Every time this topic comes up, engineers act like Claude Code was the only application for AI agents, while there's tons of use cases in other verticals aside from coding. The harness is not running on a local machine, but rather an isolated and restricted container in some cloud deployment, where running arbitrary code would be a big nope. But you still want customers to be able to connect their existing tools to your agent.

MCP is the perfect answer for this - it gives an agent a connector with built-in authentication to all kinds of additional tooling. Skills just don't qualify here at all.

Re: Zero-Touch OAuth for MCP

#82

Post by 9dev »

dend wrote: post #40
mikestorrent wrote: post #31

Earlier quoted context omitted.

Fantastic news. Is there any communication between you folks and the Microsoft Entra (Azure AD) team? Would love to know if we can expect this soon or if will take a while.

We are in touch with the Microsoft Entra ID folks to see how we can better integrate EMA in their stack!

While you're at it, bug them a bit to finally add support for MCP servers in Copilot. I'm on an Odyssey to find a way for our customers to use our MCP within their Copilot environment…

Re: Zero-Touch OAuth for MCP

#84

Post by mooreds »

programmancer wrote: post #68

I am currently trying to use Microsoft Entra ID auth for an MCP server I'm implementing, and I genuinely feel like I must be an idiot. - I can use the `WWW-Authenticate` header to indicate a resource metadata URL for the client. - I can use this to indicate an authorization server (Microsoft Entra) and a scope (for the app registration that handle which app roles each user is given to differentiate different capabili…

Yeah, I recently documented how to use pre-registered clients with FusionAuth[0] (my employer). DCR's newer, better sibling CIMD is on our radar and under active discussion[1], but not currently available.

An alternative to the proxy you suggest is to generate a new Entra client id (with PKCE enabled) for every MCP client in a developer portal or similar, then have the user configure their client with that client id. Here's the CLI command I found to do this[2], but I bet there's an API too. Here are config instructions for Claude Code[3] and ChatGPT[4].

Client pre-registration is acceptable, but not optimal, for developers, and is a first class citizen in the spec[5]. If your main audience is internal and you can expect them to follow configuration instructions to get access to the MCP server, this approach can work.

But it's definitely not acceptable for widespread, public integrations if your audience is not developers. That is where a lot of the power and opportunity for MCP lies.

0: https://fusionauth.io/docs/extend/examples/controlling-acces...

1: https://github.com/FusionAuth/fusionauth-issues/issues/3230

2: https://learn.microsoft.com/en-us/cli/azure/ad/app?view=azur...

3: https://code.claude.com/docs/en/mcp

4: https://developers.openai.com/api/docs/guides/developer-mode

5: https://modelcontextprotocol.io/specification/2025-11-25/bas...

Re: Zero-Touch OAuth for MCP

#85

Post by mooreds »

ashu1461 wrote: post #83

Looks like something which will be only helpful for bigger companies who have centralised auth. Good step nonetheless

Yeah, I read this and thought "makes total sense that Okta would be one of the prime movers behind this". The more I think about it, the more this is just like an app dashboard that an employee can use to access many different apps and that the enterprise can use to control and monitor access. So it makes total sense that they solved this (very real) problem.

I like one of the author's characterizations[0].

> Now employees no longer have to connect MCP servers manually and wait for a series of OAuth and login prompts. Once you log in to Claude from Okta, all the preconfigured MCP servers are already connected! It's not every day you get to improve both usability and security!

0: https://aaronparecki.com/2026/06/18/12/claude

Re: Zero-Touch OAuth for MCP

#86

Post by mooreds »

sean_lynch wrote: post #14

Before you get too far into the usual “MCP is dead, Skills forever” debate The real valuable capability MCP offers over skills/CLI is isolating the auth flow outside of the agent’s context window, and potentially out of the harness completely. This is valuable from a security perspective obviously. It’s also just a much easier user experience for normies and large businesses adopting AI tools. I hear all the context…

I think that this extension points out other benefits to MCP over skills:

   * centralized control
   * ease of use for employees
   * auditing/compliance
   * deployment model
It seems the state of the art for deploying skills is "copy this file and put it in this place" or "check out this repo and add a symlink" or "run this slash command to install the skill". (I'm not aware of any solution that pushes skills out.)

These options are simple, but not as easy as this extension makes rollout of a new MCP server to an employee.

Re: Zero-Touch OAuth for MCP

#87

Post by mooreds »

dend wrote: post #15

Hey folks - I am one of the folks at Anthropic that helped deliver this in partnership with Okta and a handful of MCP partners. We're very excited about this taking shape in Claude (in addition to the MCP spec, of course, where EMA is now a stable extension) and are looking to expand adoption to other identity providers and clients as well. If you have any feedback, feel free to drop it in here! Always happy to hear…

Hiya, congrats on shipping!

Seems like the main use case is employees of companies. Is there an analogous use case/value for non-centralized users like customers or freemium users?

I'm struggling to think of one, but wonder what I'm missing.

Edit: I see you addressed this here: https://news.ycombinator.com/item?id=48594381

Re: Zero-Touch OAuth for MCP

#88

Post by mooreds »

SkyPuncher wrote: post #45
dend wrote: post #15

Hey folks - I am one of the folks at Anthropic that helped deliver this in partnership with Okta and a handful of MCP partners. We're very excited about this taking shape in Claude (in addition to the MCP spec, of course, where EMA is now a stable extension) and are looking to expand adoption to other identity providers and clients as well. If you have any feedback, feel free to drop it in here! Always happy to hear…

This is great for normal "apps". We have a really deep need for a lower touch way for our users to interact with us agentically without setting up MCP. It'd be really great to have some sort of temporary session or out-of-band token storage available. Here's our use case: During the sales cycle, the buyer and seller need to exchange a bunch of information then analyze it (which is increasingly agentic). The problem w…

> The problem with MCP is the initial setup friction is far greater than users login in themselves and grabbing the information they need.

Can you tell me more about this? With just-in-time client registration (DCR or CIMD) it seems like the MCP registration would be pretty simple.

Is it the configuration of the MCP client to know about the MCP server that is the issue?

Does the website need to be able to advertise "here's the corresponding MCP server" so that the "claude hits website" step becomes "claude hits website, discovers MCP server"?

Re: Zero-Touch OAuth for MCP

#89

Post by icholy »

programmancer wrote: post #68

I am currently trying to use Microsoft Entra ID auth for an MCP server I'm implementing, and I genuinely feel like I must be an idiot. - I can use the `WWW-Authenticate` header to indicate a resource metadata URL for the client. - I can use this to indicate an authorization server (Microsoft Entra) and a scope (for the app registration that handle which app roles each user is given to differentiate different capabili…

[dead]

Re: Zero-Touch OAuth for MCP

#90

Post by debarshri »

mooreds wrote: post #86
sean_lynch wrote: post #14

Before you get too far into the usual “MCP is dead, Skills forever” debate The real valuable capability MCP offers over skills/CLI is isolating the auth flow outside of the agent’s context window, and potentially out of the harness completely. This is valuable from a security perspective obviously. It’s also just a much easier user experience for normies and large businesses adopting AI tools. I hear all the context…

I think that this extension points out other benefits to MCP over skills: * centralized control * ease of use for employees * auditing/compliance * deployment model It seems the state of the art for deploying skills is "copy this file and put it in this place" or "check out this repo and add a symlink" or "run this slash command to install the skill". (I'm not aware of any solution that pushes skills out.) These opti…

All the points that you are mentioning, you can technically do with tools too. We do that at adaptive [1]. We are building privileges access stuff for agents, and it works. The usecases you are mentioning can be done with tools via our platform.

[1] https://adaptive.live

Post reply on HN