Companies using AI and MCPs often start with simple API keys for authentication. However, this method is insecure as keys are stored in plaintext, lack expiration, and cannot be individually revoked. The MCP specification recommends using OAuth 2.1 for better security. The intended OAuth flow involves Dynamic Client Registration (DCR), where clients automatically register with an authorization server by pasting a URL.Many identity providers, like Entra ID and Cloudflare Access, do not natively support DCR. This forces a manual OAuth setup, negating the ease of use and self-onboarding features of DCR. This is known as the "DCR wall."The mcp-sso tool acts as a bridge, resolving this issue. It emulates a DCR server for MCP clients, facilitating the OAuth flow using PKCE and consent. Simultaneously, it integrates with existing identity providers like Cloudflare Access or Entra ID to verify user identities and enforce policies. mcp-sso then issues its own scoped tokens, ensuring that the identity provider's tokens never reach the client.This setup allows for a secure, user-friendly experience where clients can connect simply by pasting a URL, with authentication managed by the company's established identity provider. The tool has been successfully tested with multiple MCP clients and IdPs, demonstrating its practical application. Security features include fail-closed mechanisms, hashed single-use codes, and a published threat model. Future development plans include broader OIDC support and presets for popular identity providers.