Enterprise Interest Group Charter changedcommunity/interest-groups/enterprise
Nearest release: v2.1.322, published 23 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 11 Nov 2026 01:57 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 11 Nov 2026 02:07 UTC.
Upstream edited
Recorded here
Lines+6added
Lines−6removed
From line
17
where the diff opens
First seen
30 Aug 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 17, old and new numbered
/
from line 17
1717### In Scope
1818
1919* **Enterprise Requirements Gaps (overarching focus)**: The group’s primary mandate is identifying enterprise deployment requirements that are not addressed at the MCP protocol level today and turning them into problem statements and recommendations for the relevant Working Groups. Each requirement is captured with the enterprise opportunity it represents, not only the pain point, since closing these gaps is what unlocks broader enterprise adoption and value. The specific domains below are explored through that lens; governance and best-practice patterns are documented only where they surface a protocol-level gap:
20* **Enterprise Authentication and Identity**: Discussion of enterprise-managed auth patterns including IdP integration (SSO, SAML, OIDC), token lifecycle management, On-Behalf-Of (OBO) token exchange flows, and fine-grained authorization (Rich Authorization Requests). Gathering requirements to inform the Auth WG and related SEPs.
20* **Enterprise Authentication and Identity**: Discussion of enterprise-managed auth patterns including IdP integration (SSO, SAML, OIDC), token lifecycle management, On-Behalf-Of (OBO) token exchange flows, and fine-grained authorization (Rich Authorization Requests). Gathering requirements to inform the Authorization IG and related SEPs.
2121* **Identity Propagation and Session Context**: Defines how verified identity is surfaced and conveyed across MCP clients, servers, and downstream services for policy enforcement and audit. This includes spawned-agent and delegated-agent use cases: identity lineage, least-privilege for child agents, descendant revocation, and auditability across multi-agent chains, which is adjacent to authentication but distinct in focus.
2222* **Audit, Observability, and Compliance**: Exploration of standardized audit trail formats for MCP tool invocations, integration with enterprise SIEM and observability platforms, and evidence generation for compliance frameworks (SOC 2, HIPAA, GDPR, EU AI Act). Includes sector-specific compliance patterns such as PHI handling and BAA-scoped data flows in healthcare environments.
2323* **Gateway and Proxy Behavior**: Documentation of enterprise deployment patterns where MCP traffic routes through API gateways, load balancers, reverse proxies, and security proxies. With the move to a stateless protocol core in the 2026-07-28 release, the focus shifts from session affinity to gaps that persist in a stateless model: header and context propagation, authorization handoff across proxies, and policy enforcement at the gateway.
from line 26
2626* **Configuration Portability and Deployment**: Discussion of challenges in deploying MCP servers across heterogeneous client environments, multi-tenant configuration patterns, and enterprise-scale rollout practices.
2727* **Interceptors and Middleware**: Exploration of use cases for request/response interception in MCP pipelines, including PII redaction, compliance validation, content filtering, and hallucination detection. Gathering requirements that may inform future specification work on middleware patterns.
2828* **Problem Statements and Use Cases**: Documentation of enterprise pain points and production failure scenarios (anonymized) to build an evidence base for prioritizing specification work.
29* **Recommendations to Working Groups**: Providing structured input from enterprise practitioners to the Auth WG, Security IG, Gateways IG, and other groups on enterprise-specific requirements.
29* **Recommendations to Working Groups**: Providing structured input from enterprise practitioners to the Authorization IG, Security IG, Gateways IG, and other groups on enterprise-specific requirements.
3030
3131### Out of Scope
3232
from line 33
3333* Writing or owning SEPs. The Enterprise IG produces problem statements, use cases, and recommendations. Concrete specification changes are driven through the appropriate Working Groups.
3434* Discussion of product-specific or vendor-specific solutions. Discussions must remain vendor-neutral and focused on protocol-level patterns.
3535* General MCP support or onboarding. The group focuses on enterprise deployment challenges, not introductory MCP topics.
36* Overlapping directly with the Auth WG's specification work. The Enterprise IG gathers enterprise auth requirements and feeds them to the Auth WG rather than proposing auth protocol changes.
36* Overlapping directly with the Authorization IG's specification work. The Enterprise IG gathers enterprise auth requirements and feeds them to the Authorization IG rather than proposing auth protocol changes.
3737
3838### Related Groups
3939
4040#### Working Groups
4141
42* **Auth WG** — Enterprise auth requirements (IdP integration, OBO flows, RAR) are gathered and provided as input to the Auth WG's specification work.
43* **Transport WG** — Transport-level needs for enterprise support (non-functional requirements such as latency and horizontal scaling) are bundled and provided as input to the Transport WG.
42* **[Transports WG](https://modelcontextprotocol.io/community/working-groups/transports.md)** — Transport-level needs for enterprise support (non-functional requirements such as latency and horizontal scaling) are bundled and provided as input to the Transports WG.
4443* **Extensions WG** — Requirements for extensions other than authorization are bundled and provided as input to the Extensions WG.
4544
4645#### Interest Groups
4746
47* **[Authorization IG](https://modelcontextprotocol.io/community/interest-groups/auth.md)** — Enterprise auth requirements (IdP integration, OBO flows, RAR) are gathered and provided as input to the Authorization IG's specification work.
4848* **Security IG** — Overlapping interest in runtime security, tool poisoning, and credential management. The Enterprise IG focuses on the organizational and governance dimensions; the Security IG focuses on threat models and protocol-level mitigations.
4949* **Gateways IG** — Direct overlap on gateway/proxy behavior patterns. The Enterprise IG provides enterprise deployment context; the Gateways IG focuses on technical gateway specifications.
5050* **Financial Services IG** — Several enterprise concerns (compliance, audit, regulated environments) overlap with the FS-IG. Cross-posting and joint sessions will be coordinated where appropriate.
from line 98
9898| - | - | - | - |
9999| Enterprise Pain Points Catalog | Planned | Q2 2026 | Raghu Chandra |
100100| Healthcare & Compliance Use Cases (PHI, BAA) | Planned | Q3 2026 | Aman s |
101| Enterprise Auth Requirements (input to Auth WG) | Planned | Q3 2026 | TBD |
101| Enterprise Auth Requirements (input to Authorization IG) | Planned | Q3 2026 | TBD |
102102| Gateway Deployment Patterns Document | Planned | Q3 2026 | TBD |
103103
104104## Changelog
No line in this hunk matches that.