New infrastructure for MCP servers that require enterprise cross-account OAuth authentication. The flow:
- Performs Protected Resource Metadata (PRM) discovery against the MCP server URL
- Exchanges an identity provider ID token for an intermediate JWT Authorization Grant (ID-JAG)
- Exchanges the ID-JAG for an access token at the authorization server via the
urn:ietf:params:oauth:grant-type:jwt-bearergrant type
ID tokens are cached in user config keyed by normalized IdP URL. This is infrastructure for enterprise MCP authentication scenarios; end users will see this flow when their MCP server requires cross-account auth.
Evidence
New XAA implementation (search for "XAA: PRM discovery failed")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.