{"version":"2.1.83","anchor":"xaa-idp-authentication-for-mcp-servers","canonical_anchor":"xaa-idp-authentication-for-mcp-servers","heading":"XAA IdP Authentication for MCP Servers","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.83\/e\/xaa-idp-authentication-for-mcp-servers","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.83","markdown":"### XAA IdP Authentication for MCP Servers\n\n**What**\n\nEnterprise-grade OIDC authentication for MCP servers using the SEP-990 standard. Configure once and all XAA-enabled MCP servers authenticate silently using cached identity tokens.\n\n**Usage**\n\n`# One-time setup: configure IdP connection claude mcp xaa setup # Login (opens browser for OIDC flow) claude mcp xaa login # Check current connection claude mcp xaa status # Clear configuration claude mcp xaa clear` **Details** - Performs full OIDC discovery from the IdP issuer URL - Browser-based authorization with a local callback server on loopback - Caches `id_token` with automatic expiration; use `--force` to re-login - Supports `--client-id`, `--issuer`, `--callback-port`, and `--id-token` flags - Client secret can be read from the `MCP_XAA_IDP_CLIENT_SECRET` environment variable - Settings stored include `issuer`, `clientId`, `callbackPort`, and optionally `clientSecret` (in secure storage) **Evidence** XAA authentication system (search for `\"XAA IdP\"`, `\"claude mcp xaa\"`, `\"SEP-990\"`)"}