Enterprise-Managed Authorization (EMA)

Enterprise-Managed Authorization is the MCP extension that moves the access decision from the end user to the organization. It reached stable status on 2026-06-18 and lives in modelcontextprotocol/ext-auth, a separate repository from the core specification, whose extensions the README describes as optional, additive, composable and versioned independently of the revision cycle.

The mechanism is an application of an IETF draft rather than something MCP invented. The specification profiles the Identity Assertion JWT Authorization Grant, itself a profile of Identity Chaining Across Trust Domains, and assigns the MCP roles to it: the MCP client is the OAuth client, the MCP server is the resource server, the authorization server is whichever one the MCP server advertises in its Protected Resource Metadata under RFC 9728, and the enterprise identity provider is the IdP authorization server.

The flow runs in three steps. A user signs in to the MCP client through the organization's IdP over OpenID Connect or SAML. The client then sends a token exchange request under RFC 8693, presenting its ID token or refresh token along with the identifier of the MCP server it wants to reach, and receives an Identity Assertion JWT Authorization Grant, or ID-JAG. It presents that grant to the MCP server's authorization server as a JWT authorization grant under RFC 7523, and if the grant validates, receives an access token. The specification is explicit that the user is never redirected through a per-server consent screen: the IdP evaluated the policy already, against the group membership and roles it holds.

That shifts three things at once. Administrators enable a server once for the organization rather than each employee authorizing it; access decisions and their audit trail live in the IdP console instead of being distributed across whatever each user happened to approve; and because there is no interactive account picker, a personal account cannot be attached to a corporate tool by accident.

The stable announcement names its first implementers. Okta is the first supported identity provider, exposing the extension through its Cross App Access protocol. On the client side, Anthropic implemented it in the shared MCP layer behind Claude Code and its sibling products, and Visual Studio Code added support in the IDE. On the server side the post lists Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase as supporting it, with Slack described as actively adding support.