XAA IdP Authentication for MCP Servers / Claude Code v2.1.83

What

Enterprise-grade OIDC authentication for MCP servers using the SEP-990 standard. Configure once and all XAA-enabled MCP servers authenticate silently using cached identity tokens.

Usage

# One-time setup: configure IdP connection
claude mcp xaa setup

# Login (opens browser for OIDC flow)
claude mcp xaa login

# Check current connection
claude mcp xaa status

# Clear configuration
claude mcp xaa clear

Details

Performs full OIDC discovery from the IdP issuer URL
Browser-based authorization with a local callback server on loopback
Caches id_token with automatic expiration; use --force to re-login
Supports --client-id, --issuer, --callback-port, and --id-token flags
Client secret can be read from the MCP_XAA_IDP_CLIENT_SECRET environment variable
Settings stored include issuer, clientId, callbackPort, and optionally clientSecret (in secure storage)

Evidence

XAA authentication system (search for "XAA IdP", "claude mcp xaa", "SEP-990")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.83 →

The build it came inv2.1.83

24 Mar 2026 · 25 entries, this one is #5.

Either side of it

v2.1.81Older
v2.1.84Newer

Open the release →

Names in this entry

cli--force
Auto-memory file deletion now rejects every flag except -f or --force, so fewer commands slip through.
cli--client-id
When an MCP server rejects Claude Code's automatic sign-in registration, Claude Code now suggests concrete next steps instead of a bare error
cli--callback-port
When an MCP server rejects Claude Code's automatic sign-in registration, Claude Code now suggests concrete next steps instead of a bare error
cli--id-token
--id-token <jwt> is an option of claude mcp xaa login, which caches an identity-provider id_token so MCP servers added with --xaa authenticate silently. It writes the given JWT straight into that cache, skipping the OIDC browser login, and prints its expiry. It needs an IdP connection from claude mcp xaa setup first.
envMCP_XAA_IDP_CLIENT_SECRET
Client secret for the XAA identity provider, read by claude mcp xaa setup only when --client-secret is passed: after writing the issuer and client id to user settings, the command saves the secret to secure storage (the keychain) under the --issuer URL. Passing --client-secret without this variable set fails with Error: --client-secret requires MCP_XAA_IDP_CLIENT_SECRET env var.
settingissuer
MCP OAuth token refresh retries smarter and keeps your saved redirect URI across reconnects.

Is this right?