MCP Authentication Debugger Goes Open Source
Desperate_Hat_9561 · reddit · 2026-07-14
A developer has open-sourced an XAA debugger that locally simulates an enterprise IdP and AI client, making it easy to test the authentication flow of an MCP server independently.
The author previously worked on Asana's API / Developer Platform, including the OAuth auth server, MCP server platform, and public REST API. They mention migrating various MCP client registration methods, ranging from open DCR and closed DCR with redirect-URI whitelists, to pre-registration modes.
The core feature here is the Enterprise-Managed Auth (EMA) extension: integrating the (user + client + resource policy) directly into the protocol, which originally required team maintenance. The tool provides:
- A complete 6-step flow simulation: discovery → client registration → simulated SSO → ID-JAG issuance → JWT-bearer exchange → MCP call
- Sequence diagram logs for every request/response step
- RFC compliance checks for various ID-JAG fields
- 9 intentionally malformed samples to verify if the server correctly rejects them
- Simulated user ID configuration to test behaviors under different identities
The author also notes an interoperability pitfall: strict RFC 8414 validation fails if the issuer is on the root domain and the AS is on a subpath. They encountered this issue during early integration with Scalekit, prompting them to add an optional path-scoped AS mode.
More from coding & agent
- Multiagent v2 playbook calls for 64 agents, diverse proof routes and adversarial checks — danshipper · 2026-07-21
- Users can run FABLE 5, KIMI K3, and Grok 4.5 inside Codex via OpenCodex — iamfakhrealam · 2026-07-21
- Hermes Agent adds built-in Word, Excel, PDF and PowerPoint support — Teknium · 2026-07-21
- Super Proxy open-sources a self-hosted multi-provider LLM gateway with fallback and cost caps — Delicious-Flan88 · 2026-07-21
- Open-source MCP server connects Screener.in to live financial data for LLM research workflows — ashutosh_811 · 2026-07-21
- Marker 2 claims better quality than MinerU and docling while hitting 27 pages/sec — VikParuchuri · 2026-07-21