MCP Authentication Debugger Goes Open Source

Desperate_Hat_9561 · reddit · 2026-07-14

A developer has open-sourced an XAA debugger that locally simulates an enterprise IdP and AI client, making it easy to test the authentication flow of an MCP server independently.

The author previously worked on Asana's API / Developer Platform, including the OAuth auth server, MCP server platform, and public REST API. They mention migrating various MCP client registration methods, ranging from open DCR and closed DCR with redirect-URI whitelists, to pre-registration modes.

The core feature here is the Enterprise-Managed Auth (EMA) extension: integrating the (user + client + resource policy) directly into the protocol, which originally required team maintenance. The tool provides:

The author also notes an interoperability pitfall: strict RFC 8414 validation fails if the issuer is on the root domain and the AS is on a subpath. They encountered this issue during early integration with Scalekit, prompting them to add an optional path-scoped AS mode.

Original post →

More from coding & agent

coding & agent channel →