{"version":"2.1.218","anchor":"mcp-xaa-cross-account-authentication-via-jwt-bearer","canonical_anchor":"mcp-xaa-cross-account-authentication-via-jwt-bearer","heading":"MCP XAA (Cross-Account Authentication) via JWT-Bearer","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.218\/e\/mcp-xaa-cross-account-authentication-via-jwt-bearer","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.218","markdown":"### MCP XAA (Cross-Account Authentication) via JWT-Bearer\n\nNew infrastructure for MCP servers that require enterprise cross-account OAuth authentication. The flow:\n\n- Performs Protected Resource Metadata (PRM) discovery against the MCP server URL\n- Exchanges an identity provider ID token for an intermediate JWT Authorization Grant (ID-JAG)\n- Exchanges the ID-JAG for an access token at the authorization server via the `urn:ietf:params:oauth:grant-type:jwt-bearer` grant type\n\nID tokens are cached in user config keyed by normalized IdP URL. This is infrastructure for enterprise MCP authentication scenarios; end users will see this flow when their MCP server requires cross-account auth.\n\n**Evidence**\n\nNew XAA implementation (search for `\"XAA: PRM discovery failed\"`)"}