A year and a half ago I wrote that MCP wasn't ready for the enterprise. I also said we could fix it!
A year and a half later, we did! The fix is Cross-App Access. Instead of every employee clicking through an OAuth prompt for every app they connect to their AI tools, the connection goes through the company's identity provider. The admin decides which apps can talk to each other, and users never see a consent screen. That's a lot less clicking, and the IT admin finally gets to see what's connected to what.
Back then it was a draft and a hypothetical example. Now it's shipping in over 100 places:
• 12 identity providers issuing ID-JAGs • 18 authorization servers accepting ID-JAGs • 11 clients, including Claude • 34 apps and MCP servers, including Atlassian, Figma, Slack and Zoom • 17 gateways • 23 SDKs, libraries and test tools
This isn't one vendor's ecosystem. It's an open spec in the IETF OAuth working group, implemented independently by a lot of different companies. It's also the spec behind Enterprise-Managed Authorization in MCP.
The OAuth working group meets next week at IETF 127 in San Francisco, where we'll work through what's left to finish the draft. The IETF runs on "rough consensus and running code", and boy do we have plenty of running code!
Thanks to everyone who has built, tested and given feedback on this. If you've implemented it and you're not on the list, let me know and I'll add you.
{
"type": "entry",
"published": "2026-11-09T21:49:03-08:00",
"url": "https://aaronparecki.com/2026/11/09/11/",
"category": [
"xaa",
"oauth",
"okta",
"mcp"
],
"syndication": [
"https://lnkd.in/p/d-WbyzAB"
],
"content": {
"text": "A year and a half ago I wrote that MCP wasn't ready for the enterprise. I also said we could fix it! \n\nA year and a half later, we did! The fix is Cross-App Access. Instead of every employee clicking through an OAuth prompt for every app they connect to their AI tools, the connection goes through the company's identity provider. The admin decides which apps can talk to each other, and users never see a consent screen. That's a lot less clicking, and the IT admin finally gets to see what's connected to what. \n\nBack then it was a draft and a hypothetical example. Now it's shipping in over 100 places: \n\n\u2022 12 identity providers issuing ID-JAGs \n\u2022 18 authorization servers accepting ID-JAGs \n\u2022 11 clients, including Claude \n\u2022 34 apps and MCP servers, including Atlassian, Figma, Slack and Zoom \n\u2022 17 gateways \n\u2022 23 SDKs, libraries and test tools \n\nThis isn't one vendor's ecosystem. It's an open spec in the IETF OAuth working group, implemented independently by a lot of different companies. It's also the spec behind Enterprise-Managed Authorization in MCP. \n\nThe OAuth working group meets next week at IETF 127 in San Francisco, where we'll work through what's left to finish the draft. The IETF runs on \"rough consensus and running code\", and boy do we have plenty of running code! \n\nThanks to everyone who has built, tested and given feedback on this. If you've implemented it and you're not on the list, let me know and I'll add you. \n\nhttps://oauth.net/cross-app-access/",
"html": "A year and a half ago I wrote that MCP wasn't ready for the enterprise. I also said we could fix it! <br /><br />A year and a half later, we did! The fix is Cross-App Access. Instead of every employee clicking through an OAuth prompt for every app they connect to their AI tools, the connection goes through the company's identity provider. The admin decides which apps can talk to each other, and users never see a consent screen. That's a lot less clicking, and the IT admin finally gets to see what's connected to what. <br /><br />Back then it was a draft and a hypothetical example. Now it's shipping in over 100 places: <br /><br />\u2022 12 identity providers issuing ID-JAGs <br />\u2022 18 authorization servers accepting ID-JAGs <br />\u2022 11 clients, including Claude <br />\u2022 34 apps and MCP servers, including Atlassian, Figma, Slack and Zoom <br />\u2022 17 gateways <br />\u2022 23 SDKs, libraries and test tools <br /><br />This isn't one vendor's ecosystem. It's an open spec in the IETF OAuth working group, implemented independently by a lot of different companies. It's also the spec behind Enterprise-Managed Authorization in MCP. <br /><br />The OAuth working group meets next week at IETF 127 in San Francisco, where we'll work through what's left to finish the draft. The IETF runs on \"rough consensus and running code\", and boy do we have plenty of running code! <br /><br />Thanks to everyone who has built, tested and given feedback on this. If you've implemented it and you're not on the list, let me know and I'll add you. <br /><br /><a href=\"https://oauth.net/cross-app-access/\"><span>https://</span>oauth.net/cross-app-access/</a>"
},
"author": {
"type": "card",
"name": "Aaron Parecki",
"url": "https://aaronparecki.com/",
"photo": "https://aperture-media.p3k.io/aaronparecki.com/41061f9de825966faa22e9c42830e1d4a614a321213b4575b9488aa93f89817a.jpg"
},
"post-type": "note",
"_id": "50186547",
"_source": "16"
}
If you cite a Google Search URL for an “interesting” or especially a new term, use the "npfr=1" query parameter to force Google to return results for your literal search, instead of auto-correcting it, either to a related older term, or potentially something new and popular in the future.
E.g. If I wanted to direct you to search results for the word "faschadenfreude“, I would share this link:
Without the "nfpr" parameter, the query would have redirected to showing you results for merely "schadenfreude“.
Due to some amount of recency bias in search (and LLM) indices, news and other events can impact what words and phrases are these services redirect you to. Since new words and phrases can and will get more attention, there’s no way to predict if or when any search you link to will be redirected to something else in the future.
The only way to be sure a Google search results link in a blog post shows what you intend is to add the "&nfpr=1" URL query parameter to the link in your post.
This is post 22 of #100PostsOfIndieWeb. #100Posts #indieweb
{
"type": "entry",
"published": "2026-11-09 09:54-0800",
"url": "https://tantek.com/2026/313/t1/google-search-url-query-nfpr-literal",
"category": [
"100PostsOfIndieWeb",
"100Posts",
"indieweb",
"search",
"GoogleSearch",
"tip",
"searchTip",
"GoogleTip",
"GoogleSearchTip"
],
"content": {
"text": "If you cite a Google Search URL for an \u201cinteresting\u201d or especially a new term, use the \"npfr=1\" query parameter to force Google to return results for your literal search, instead of auto-correcting it, either to a related older term, or potentially something new and popular in the future.\n\nE.g. If I wanted to direct you to search results for the word \"faschadenfreude\u201c, I would share this link:\n\nhttps://www.google.com/search?q=faschadenfreude&nfpr=1\n\nWithout the \"nfpr\" parameter, the query would have redirected to showing you results for merely \"schadenfreude\u201c.\n\nDue to some amount of recency bias in search (and LLM) indices, news and other events can impact what words and phrases are these services redirect you to. Since new words and phrases can and will get more attention, there\u2019s no way to predict if or when any search you link to will be redirected to something else in the future.\n\nThe only way to be sure a Google search results link in a blog post shows what you intend is to add the \"&nfpr=1\" URL query parameter to the link in your post.\n\nThis is post 22 of #100PostsOfIndieWeb. #100Posts #indieweb\n\n\u2190 https://tantek.com/2026/263/t1/slack-pro-free-trial-old-posts-dms\n\u2192 \ud83d\udd2e\n\n#search #GoogleSearch #tip #searchTip #GoogleTip #GoogleSearchTip",
"html": "If you cite a Google Search URL for an \u201cinteresting\u201d or especially a new term, use the \"npfr=1\" query parameter to force Google to return results for your literal search, instead of auto-correcting it, either to a related older term, or potentially something new and popular in the future.<br /><br />E.g. If I wanted to direct you to search results for the word \"faschadenfreude\u201c, I would share this link:<br /><br /><a href=\"https://www.google.com/search?q=faschadenfreude&nfpr=1\">https://www.google.com/search?q=faschadenfreude&nfpr=1</a><br /><br />Without the \"nfpr\" parameter, the query would have redirected to showing you results for merely \"schadenfreude\u201c.<br /><br />Due to some amount of recency bias in search (and LLM) indices, news and other events can impact what words and phrases are these services redirect you to. Since new words and phrases can and will get more attention, there\u2019s no way to predict if or when any search you link to will be redirected to something else in the future.<br /><br />The only way to be sure a Google search results link in a blog post shows what you intend is to add the \"&nfpr=1\" URL query parameter to the link in your post.<br /><br />This is post 22 of #<span class=\"p-category\">100PostsOfIndieWeb</span>. #<span class=\"p-category\">100Posts</span> #<span class=\"p-category\">indieweb</span><br /><br />\u2190 <a href=\"https://tantek.com/2026/263/t1/slack-pro-free-trial-old-posts-dms\">https://tantek.com/2026/263/t1/slack-pro-free-trial-old-posts-dms</a><br />\u2192 \ud83d\udd2e<br /><br />#<span class=\"p-category\">search</span> #<span class=\"p-category\">GoogleSearch</span> #<span class=\"p-category\">tip</span> #<span class=\"p-category\">searchTip</span> #<span class=\"p-category\">GoogleTip</span> #<span class=\"p-category\">GoogleSearchTip</span>"
},
"author": {
"type": "card",
"name": "Tantek \u00c7elik",
"url": "https://tantek.com/",
"photo": "https://tantek.com/photo.jpg"
},
"post-type": "note",
"_id": "50184297",
"_source": "2460"
}
definition: joy or pleasure from seeing fascists lose, suffer, and experience other misfortunes, especially as consequences, direct and indirect, for their words and actions.
etymology: portmanteau of 'fascists' and 'schadenfreude'.
{
"type": "entry",
"published": "2026-11-08T13:27:09-0500",
"url": "https://martymcgui.re/2026/11/08/132709/",
"featured": "https://media.martymcgui.re/78/48/ce/43/41d5de8f39808c42da44d2dee9f5349ec784357c128407c20f3f2c48.png",
"category": [
"SFPC",
"browser",
"games"
],
"syndication": [
"https://fed.brid.gy/"
],
"content": {
"text": "Many thanks to Everest Pipkin for teaching The Browser is Already a Game Engine this past summer.\nEven more thanks for putting together this showcase of student projects from the session!\nhttps://projects.sfpc.study/the-browser-speaks/\nClick through and may fortune smile upon you!",
"html": "<p>Many thanks to <a href=\"https://everest-pipkin.com/\">Everest Pipkin</a> for teaching <a href=\"https://sfpc.study/sessions/summer-26/the-browser-is-already-a-game-engine\">The Browser is Already a Game Engine</a> this past summer.</p>\n<p>Even <em>more</em> thanks for putting together this showcase of student projects from the session!</p>\n<p><a href=\"https://projects.sfpc.study/the-browser-speaks/\">https://projects.sfpc.study/the-browser-speaks/</a></p>\n<p>Click through and may fortune smile upon you!</p>\n<p><a href=\"https://projects.sfpc.study/the-browser-speaks/\"><img class=\"u-featured\" src=\"https://media.martymcgui.re/78/48/ce/43/41d5de8f39808c42da44d2dee9f5349ec784357c128407c20f3f2c48.png\" alt=\"A wooden machine with a sunny lion's face urges you to Have Your Fortune Told\" /></a></p>"
},
"author": {
"type": "card",
"name": "Marty McGuire",
"url": "https://martymcgui.re/",
"photo": "https://martymcgui.re/images/logo.jpg"
},
"post-type": "note",
"_id": "50171988",
"_source": "175"
}
{
"type": "entry",
"published": "2026-11-08T04:13:29.561821+00:00",
"url": "https://cleverdevil.io/2026/damn-shame-we-were-without-mali-no-margi",
"syndication": [
"https://cleverdevil.club/@jonathan/117578872233655931",
"https://bsky.app/profile/cleverdevil.io/post/3mzrkcpwwhx2a"
],
"content": {
"text": "Damn. Shame we were without Mali. No margin for error now, or we will miss the playoff.",
"html": "<p>Damn. Shame we were without Mali. No margin for error now, or we will miss the playoff.</p>"
},
"author": {
"type": "card",
"name": "Jonathan LaCour",
"url": "https://cleverdevil.io",
"photo": "https://cleverdevil.io/profile/photo"
},
"post-type": "note",
"_id": "50166708",
"_source": "10"
}
{
"type": "entry",
"published": "2026-11-08T01:52:20.764975+00:00",
"url": "https://cleverdevil.io/2026/we-look-so-soft-getting-absolutely-bulli",
"syndication": [
"https://cleverdevil.club/@jonathan/117578317224432657",
"https://bsky.app/profile/cleverdevil.io/post/3mzrcgdieyh2v"
],
"content": {
"text": "We look so soft. Getting absolutely bullied. Can\u2019t punch it in from the one. Can\u2019t get home on pressure. Offense is weak. Not great.",
"html": "<p>We look so soft. Getting absolutely bullied. Can\u2019t punch it in from the one. Can\u2019t get home on pressure. Offense is weak. Not great.</p>"
},
"author": {
"type": "card",
"name": "Jonathan LaCour",
"url": "https://cleverdevil.io",
"photo": "https://cleverdevil.io/profile/photo"
},
"post-type": "note",
"_id": "50163857",
"_source": "10"
}
{
"type": "entry",
"published": "2026-11-06 13:01-0800",
"url": "https://gregorlove.com/2026/11/to-read-a-resistance-history-of-the-united-states/",
"content": {
"text": "Want to read: A Resistance History of the United States by Tad Stoermer (ISBN 9781586424367)",
"html": "<p>Want to read: <span class=\"p-read-of h-cite\"><a class=\"u-url\" href=\"https://gregorlove.com/isbn/9781586424367\">A Resistance History of the United States</a> by <span class=\"p-author\">Tad Stoermer</span> (ISBN <span class=\"p-uid\">9781586424367</span>)</span></p>"
},
"author": {
"type": "card",
"name": "gRegor Morrill",
"url": "https://gregorlove.com/",
"photo": "https://gregorlove.com/site/assets/files/6268/profile-2021-square.300x0.jpg"
},
"post-type": "note",
"_id": "50151650",
"_source": "95"
}
{
"type": "entry",
"published": "2026-11-05T03:07:55.314077+00:00",
"url": "https://cleverdevil.io/2026/ugh-of-all-the-weeks-for-malachi-toney-t",
"syndication": [
"https://cleverdevil.club/@jonathan/117561627469159956",
"https://bsky.app/profile/cleverdevil.io/post/3mzjvaplpyt2e"
],
"content": {
"text": "Ugh\u2026 of all the weeks for Malachi Toney to get injured \ud83e\udd26",
"html": "<p>Ugh\u2026 of all the weeks for Malachi Toney to get injured \ud83e\udd26</p>"
},
"author": {
"type": "card",
"name": "Jonathan LaCour",
"url": "https://cleverdevil.io",
"photo": "https://cleverdevil.io/profile/photo"
},
"post-type": "note",
"_id": "50130699",
"_source": "10"
}
