Skillget

awesome-cross-app-access

mcp
Guvenlik Denetimi
Uyari
Health Uyari
  • License — License: CC0-1.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 5 GitHub stars
Code Uyari
  • process.env — Environment variable access in scripts/discover.mjs
  • network request — Outbound network request in scripts/discover.mjs
Permissions Gecti
  • Permissions — No dangerous permissions requested

Bu listing icin henuz AI raporu yok.

SUMMARY

A curated list of resources for Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG).

README.md

Awesome Cross-App Access Awesome

A curated list of resources for Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG).

Cross-App Access is an OAuth extension that lets an enterprise identity provider govern app-to-app API access. Instead of every user clicking through a per-app OAuth consent screen, the IdP issues a signed identity assertion (the ID-JAG) that a requesting app redeems at the resource app's authorization server for an access token. Admins configure the connection once, users get access on first login, and every grant is centrally policed, scoped, and logged.

It matters most for AI agents and MCP: an agent inherits exactly the access its signed-in user already has, with short-lived tokens instead of long-lived API keys.

Contents

How it works

sequenceDiagram
    participant User
    participant RA as Requesting App<br/>(app or AI agent)
    participant IdP as Enterprise IdP
    participant AS as Resource App<br/>authorization server
    participant API as Resource App API

    User->>RA: Sign in with enterprise SSO
    IdP-->>RA: ID token
    RA->>IdP: Token exchange (RFC 8693)<br/>ID token + target resource
    IdP-->>RA: ID-JAG identity assertion
    RA->>AS: JWT bearer grant (RFC 7523)<br/>assertion = ID-JAG
    AS-->>RA: Access token
    RA->>API: Call API with access token

Terminology

Term Meaning
Requesting App The app or agent that wants to call another app's API on the user's behalf.
Resource App The app whose API is being called. Runs its own authorization server.
Identity Provider The enterprise IdP that both apps trust for SSO, and that issues the ID-JAG.
ID-JAG The identity assertion JWT the IdP issues, scoped to one requesting app, one resource, and one user.
XAA Cross-App Access, the common name for deployments of this pattern.
EMA Enterprise-Managed Authorization, MCP's profile of ID-JAG.

Specifications

Related standards

MCP and AI agents

Issuers

Every ID-JAG is minted by one party and redeemed at another, and most vendors implement only one of those sides. An issuer is the enterprise IdP: it applies the admin's access policy and mints the assertion.

  • Okta - Concept docs and configuration for XAA, the first large-scale deployment.
  • Descope - Mints ID-JAGs so the agents you run can reach third-party MCP servers and APIs, governed by policy.
  • PingFederate - Native ID-JAG minting, from the 13.1 release notes.
  • Keycloak - Upstream tracking issue for issuing ID-JAGs.
  • Athenz - ID-JAG in the Athenz open-source access-control system, in Japanese. The same write-up covers its validator side.

Validators

The other half: a validator is the resource app's authorization server, verifying an assertion minted elsewhere and returning its own access token. Clients, which request the assertion in the first place, are in the MCP and AI agents section.

  • Descope - Validates a customer's IdP assertion at the MCP server you sell, so each customer governs access with their own Okta, Entra, or Descope.
  • Auth0 - Resource-app side of XAA, in early access. The enterprise IdP stays external.
  • Stytch - Exchanges an external workforce IdP's ID-JAG for a Stytch Connected Apps access token, with no browser redirect.
  • WorkOS - Early access, enabled per environment. AuthKit accepts the assertion and returns a token scoped to your MCP server, with no ID-JAG code in the server itself.
  • Scalekit - Agentic auth flows built on ID-JAG.
  • Authplane - Checks the assertion against the IdP's JWKS and mints an MCP token for policy-approved agent, scope, and resource combinations.
  • PingFederate JWT grant mapping - Mapping an inbound assertion to a local identity.
  • Keycloak - Upstream tracking issue for accepting ID-JAGs.

Resource apps and MCP servers

Applications that let an enterprise IdP govern access to their API or MCP server.

  • Asana - Cross-App Access for the Asana API.
  • Atlassian - Enterprise-managed authentication across Atlassian products.
  • Canva - Admin controls for Cross-App Access.
  • Datadog - Org-level Cross-App Access settings.
  • Figma - Enterprise-managed auth for the Figma MCP server.
  • Granola - MCP integration with enterprise-managed authorization.
  • Linear - Enterprise-managed authorization for the Linear MCP server.
  • Notion - Enterprise-managed connections for Notion MCP.
  • Slack - Managing Slack MCP server access through your IdP.
  • Supabase - Enterprise MCP authentication for Supabase projects.

Libraries

Sample apps and demos

Sandboxes and debugging tools

  • XAA Guru - Walks the flow one hop at a time against your own IdP and MCP server, showing the exact request each step sends. Works with any ID-JAG issuer, such as Okta, Ping, or Descope. Built by Descope.
  • xaa.dev - Free hosted sandbox for exploring and debugging XAA flows with no setup.
  • client.xaa.rocks - Test requesting app you can point at your own IdP.
  • motd.xaa.rocks - Test resource app and API for validating your ID-JAG issuance.

Articles

Talks and podcasts

Community

Contributing

Contributions are welcome. Read the contribution guidelines first.

Maintained by @dorsha. Disclosure: I work at Descope, which appears in this list. Entries are included on their technical merits, and vendor entries track the implementations listed on oauth.net.

Yorumlar (0)

Sonuc bulunamadi