MCP Server Enterprise Login Compatibility

awca22 · reddit · 2026-07-18

The author details integrating MCP servers with enterprise login systems. The core challenge is that MCP clients attempt automatic OAuth client registration, unsupported by many enterprise IdPs.

Two scenarios are described:

Personal projects where MCP servers can't be exposed directly due to embedded OpenRouter keys;
Work environments needing to expose an API-key-only MCP service to AI agents and colleagues, blocked by security policies against direct key usage.

The specific roadblock: Cloudflare Access lacks support for the dynamic client registration flow expected by MCP clients, triggering the "Incompatible auth server: does not support dynamic client registration" error. The author explains how DCR works in the MCP spec and why IdPs like Entra, Okta, and Cognito disallow self-registration.

Their solution is a custom OAuth bridge layer that:

Provides /.well-known metadata;
Handles DCR and PKCE;
Registers clients to the bridge;
Connects to the actual enterprise IdP to issue short-lived, audience-bound JWTs.

This open-source project, mcp-sso, works with claude.ai, ChatGPT, Claude Code, Codex CLI, and the official MCP SDK, tested against Cloudflare Access, Google, and Entra. The author notes Claude clients only attempt CIMD if metadata declares clientidmetadatadocumentsupported: true, otherwise falling back to DCR.

Original post →

MCP Server Enterprise Login Compatibility

More from coding & agent