I've spent much of this year thinking about how to help teams adopt AI. MCPs have become a big part of that journey because all of a sudden, it seems like every company, even those who previously refused to expose an API, now has an MCP.
While this is great for end users, you need a strategy for protecting the various MCPs in use. One way to achieve this is to deploy a can help you do this. It sits in front of your MCP servers and presents MCP clients with a single endpoint where security teams can enforce organizational policy. Here's what that might look like:
If that looks like your end goal, lets start with some theory first!
Client ID Metadata Documents - CIMD
Before , but once completed, the authorization server can then use the values in the metadata document in its authorization decisions.
Unfortunately, as of May 2026, Okta authorization servers do not support CIMD.
The OAuth proxy
To workaround this, we'll need a proxy. Instead of registering the CIMD clients in Okta, we create an Okta returns an authorization URL and a session URI, and AgentCore Gateway surfaces them as a -32042 URL .
Session binding ensures that the user who initiated the tool call that needs authorization is the same user who granted consent. Without it, if the initiating user forwards the authorization URL and someone else completes the GitHub consent flow, their GitHub access token would get stored in the which signals to AgentCore that its safe to get an access token for the user, i.e bind the session . Once the binding succeeds, AgentCore Identity caches the GitHub access token for that user in the token vault, and subsequent tool calls complete normally.
, , and MCP clients that the proxy the proxy's authorization server capabilities, the presented client_id and redirect_uri against the metadata document, then Okta's authorization code, verifies the state HMAC and re-validates the CIMD redirect_uri, then forwards the code to the MCP client's original redirect URI.
/tokenAgentCore Identity's 3LO return redirect, looks up the session binding, then redirects to Okta with
prompt=none to silently identify the current browser user./sessionbinding/okta-callbackif they match.
/{full_path:path}requests with a 400 since only CIMD clients are trusted.
SOCIAL SHARE CARD GENERATOR