Enterprise-Managed Authorization (EMA) lets an employee sign into an MCP client with company SSO and find every MCP server already connected — no consent screens, no API keys. Arcade.dev's Nate Barbettini and Wils Dawson sit down with Okta's Aaron Parecki and Anthropic's Paul Carleton to unpack how it works.
MCP stayed quiet on how clients should handle refresh tokens, so behavior drifted across the ecosystem. Wils Dawson on the clarification landing in the 2026 MCP release, and why refresh tokens are the gap that only shows up in production.
Connect Arcade.dev MCP Gateways to the identity provider your company already runs. Deploying an agent to ten people or ten thousand looks the same.
You tell your AI agent: “Send that report to my manager.” It drafts the perfect message — and then stops. The problem isn’t intelligence; it’s identity. It can’t press “send,” because your email — like every good enterprise system — lives behind an auth wall. That’s the invisible barrier keeping AI from doing real work: agents can’t safely act on behalf of their users. That small roadblock points to a much bigger one. AI agents can reason, plan, and communicate — but they’ve been locked out
See URL Mode Elicitation in Action → Watch our engineer Will Dawson walk through the new MCP proposal that's solving one of the biggest security gaps in AI tool-calling. In 15 minutes, you'll see how agents can finally handle OAuth flows, payment confirmations, and API keys without exposing sensitive data to the LLM. Watch the technical walkthrough → Your AI agent needs to search Gmail for that weekly report. You've built an MCP server, the tool definition, everything's wired up perfectly. One
After eight years building authentication systems at Okta, followed by stints at Kong and ngrok working on developer tools and API gateways, I've seen how to build systems that are secure by default. Now at Arcade.dev, I'm watching the MCP ecosystem struggle to get there. The Model Context Protocol has incredible potential for enabling AI agents to interact with real-world systems. But there's a gap between experimental implementations and production-ready infrastructure that most developers ar
