Watch

cliffhall d68202a88b docs(spec): add V2 Auth landing page and canonicalize spec top menus (closes #1605 )

Add a specification/v2_auth.md landing page summarizing the four auth specs
(EMA / XAA, Hardening, Mid-session, Smoke testing) with a section submenu,
mirroring the V2 UX index pattern.

Add a V2 Auth link (after V2 UX) and a V2 New Spec Impact link to every spec
page's top menu so the top-level nav is uniform, and restructure the four
v2_auth_*.md pages onto the shared two-tier menu (top menu + auth submenu).

Docs only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

2026-07-02 17:20:06 -04:00

2.8 KiB

Raw Blame History

Inspector V2 Authorization - Specification

Brief | V1 Problems | V2 Scope | V2 Tech Stack | V2 UX | V2 Auth | V2 New Spec Impact

Overview | EMA / XAA | Hardening | Mid-session | Smoke testing

Inspector v2's authorization support spans OAuth 2.1 connect-time flows, Enterprise-Managed Authorization (EMA / XAA), mid-session credential recovery, and the hardening required by the MCP 2026-07-28 specification. This page is the landing point for that work; each area has its own spec below.

Inspector already ships connect-time OAuth and EMA infrastructure (core/auth/, core/mcp/oauthManager.ts, per-server OAuth fields in ~/.mcp-inspector/mcp.json — see Servers file). The specs here cover extending that foundation across web, TUI, and CLI.

Authorization specs

EMA / XAA

Support for Enterprise-Managed Authorization (EMA, also referred to as XAA / ID-JAG). EMA extends the OAuth flow so an enterprise IdP (OIDC) can authenticate the client once; any MCP resource authorization server configured to trust that IdP is then accessible with minimal or no user prompting. Covers the web connect flow (implemented in core/auth/ema/), install-level client.json persistence, and wiring into InspectorClient.

Hardening

Aligns Inspector with the six authorization SEPs in the MCP 2026-07-28 release candidate — all OAuth client requirements (iss validation per RFC 9207, application_type in DCR, credentials bound to AS issuer, and more). Strategy: upgrade to the v2 TypeScript SDK (@modelcontextprotocol/client) and wire the gaps rather than reimplementing SDK OAuth logic. Covers connect-time and storage hardening that mid-session builds on.

Mid-session

Detecting when in-flight MCP traffic needs new or elevated credentials, responding with the correct OAuth or EMA flow, and restoring the connection — across web, TUI, and CLI. Generalizes beyond expired access tokens to step-up authorization (a 403 with insufficient_scope and per-operation scopes, per SEP-2350). Addresses the web client's token-snapshot constraint, where MCP runs on the Hono backend and cannot complete interactive OAuth on its own.

Smoke testing

Manual smoke procedures for exercising Inspector OAuth against hosted MCP servers, complementing the automated integration coverage. Records known-good real endpoints, which client-ID mechanism each server supports, and how to configure Inspector (web, TUI, or CLI) via install-level client.json.

2.8 KiB Raw Blame History