{"version":"2.1.86","anchor":"xaa-cross-app-access-protocol-expansion","canonical_anchor":"xaa-cross-app-access-protocol-expansion","heading":"XAA (Cross-App Access) Protocol Expansion","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.86\/e\/xaa-cross-app-access-protocol-expansion","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.86","markdown":"### XAA (Cross-App Access) Protocol Expansion\n\nThe MCP OAuth cross-app access (XAA) system has received a major expansion with full PRM (Protected Resource Metadata) discovery, AS (Authorization Server) metadata discovery, and a two-stage token exchange flow (ID token \u2192 ID-JAG \u2192 access token). New `--xaa`, `--client-id`, and `--client-secret` flags are now available for MCP server configuration. A dedicated `XaaTokenExchangeError` class provides better error handling with per-stage failure tracking.\n\n**Evidence**\n\nXAA protocol flow (search for `\"XAA: starting cross-app access flow\"`) \u2014 `eB1()` at line ~327934"}