Drop-in MCP enterprise auth for Microsoft Entra ID — no hand-rolled DCR proxy, with automatic re-auth on token expiry
Developers building Model Context Protocol servers for enterprises keep hitting the same wall: the MCP auth spec assumes OAuth Dynamic Client Registration (DCR), but Microsoft Entra ID — the dominant enterprise IdP — doesn't support DCR, so each builder hand-rolls a proxy that injects a fixed client_id and pretends to the client that DCR works. On top of that, clients like OpenAI Codex dead-end when a refresh token expires, halting with a manual re-auth prompt instead of recovering. The opening is a drop-in SDK/gateway that gives spec-compliant proxy-with-fallback for Entra plus robust automatic re-auth, so builders stop rebuilding the same shim.
Don't pitch 'an MCP auth gateway' generically — the sharp wedge is the two specific failures people name: Entra-no-DCR (a clean proxy-with-fallback that handles the app-registration plumbing for the builder), and clients that halt on an expired refresh token instead of recovering. The auto re-auth loop is the part even OpenAI's own client gets wrong today, so nail that.
landscape (3 existing solutions)
The ecosystem agrees Entra can't do DCR and has converged on the same manual OAuth-proxy shim; Anthropic just shipped enterprise-managed auth but Okta-only, leaving the Entra builder experience and the refresh-token-expiry dead-end unsolved.