Pippa: Tyler, you see this Model Context Protocol post? They're shipping zero-touch OAuth for MCP servers.
Tyler: ‘Zero-touch OAuth' sounds like the kind of phrase that buries a ‘but you have to write an Okta policy’ clause, so yeah—let’s pull the stitching apart.
Tyler: The article says per-user consent is the real friction in enterprise MCP.
Pippa: Which is true for teams that still hand-roll per-server OAuth flows and wonder why nothing connects on first login.
Tyler: Okay, but how many enterprises actually live in the ‘per-user consent is the bottleneck’ world instead of the ‘our IdP policy is already a graveyard of bespoke group rules’ world?
Pippa: Right. Still, there’s a real thing you can’t hack around: onboarding humans to twenty services one OAuth screen at a time creates drag you can’t metricize away.
Tyler: Sure, sure. The extension lets the IdP become the gatekeeper.
Tyler: Client grabs an Identity Assertion JWT Authorization Grant during SSO and swaps it for an MCP server token—no per-server redirect.
Pippa: Elegant, and you avoid the personal-work blurring too.
Tyler: Three touted wins: authorize once and inherit everywhere, centralized audit trail, and banish the per-server consent screen—so no more ‘which account did I use here’ confusion.
Pippa: Which is exactly the pain point our Fortune 500 PMs kept emailing us about last quarter.
Tyler: Right, and I’m happy the flow is clean—but at the risk of being the compliance guy in the room, moving the friction from client OAuth dialogs to IdP policy pages ain’t eliminating friction.
Pippa: No, but it’s moving it to the place that already owns the blast radius: the security org.
Tyler: Mm-hm. Still, the coalition reads like a who’s who of vendors chasing ‘connected on first login’ magic.
Tyler: Anthropic’s shared MCP layer, Okta’s Cross App Access, VS Code support, and servers like Figma and Linear—impressive launch bench.
Pippa: The quote from Okta’s Aaron Parecki even calls it the new baseline for enterprise MCP.
Tyler: Baseline implies everyone’s starting from scratch. Some orgs have already wired half their tools to their IdP through existing OAuth patterns.
Pippa: True, but how many of those OAuth patterns actually reach MCP servers today with zero config?
Tyler: Exactly my point. EMA feels like the upgrade path when your IdP already has muscles for app provisioning.
Tyler: So if your IdP is rusty on cross-app access, the ‘zero-touch’ story weakens fast.
Pippa: Wait—you’re saying the real bottleneck moves from per-server OAuth dialogs to IdP policy complexity?
Tyler: I’m saying the idempotent claim—‘log in once and you’re connected’—assumes the IdP can express the policy cleanly. If your IdP group naming is a swamp of nested includes, suddenly the per-server dialog moved to a policy dialog.
Pippa: Okay, so you have to tidy your IdP anyway.
Tyler: Yeah. And the audit trail sounds sexy until you realize every MCP server still needs to ingest IdP decisions—which means they still need to parse JWTs and handle revocation checks.
Pippa: Which the spec calls out—they’ve got a section on auth server expectations.
Tyler: Right, ‘expectations.’ Translate that to ‘you’ll build at least one new micro-service to parse those tokens without leaking.’
Pippa: So the marketing line is zero-touch. The engineering line is you’re shipping one more auth endpoint.
Tyler: Precisely the kind of ‘shipped, but not solved’ loop we’ve seen before.
Pippa: Okay, but hold on—remember when we said MCP finally became enterprise-ready when it added protocol-level boundaries instead of piling on features?
Tyler: I remember, and I’ll concede the fit—the EMA extension is squarely in protocol/boundary space.
Pippa: So it’s not a feature. It’s a protocol-level boundary.
Tyler: And the boundary is: IdP as gatekeeper, not per-server consent screen. Still, someone has to wire that boundary into every MCP server.
Pippa: Which means the vendors in the coalition have already done it—Figma, Linear, Supabase—they’re the ones touting ‘magic.’
Tyler: And every other MCP server has to play catch-up or get left behind.
Tyler: Every. Single. Time.
Pippa: Alright, that’s enough MCP identity catharsis for one Wednesday.