MCP OAuth: Per-User Account Selection

Paste https://mcp.stackone.com/mcp into any MCP client and it now runs an OAuth flow: the user signs in to StackOne and picks which of their own linked accounts that client may use, down to the individual actions on each one. Accounts are listed for the project they select. They come away with authenticated access to only the accounts they already have, without handling a provider credential. Rolling an agent out to a few hundred employees previously meant a developer building per-user credential handling, or pointing the agent at one shared service account that no log could attribute to a person.

The URL is the same for everyone in the organization and carries no access on its own, so it is safe to put in an internal wiki or a helpdesk article.

What’s new

• Multi-account selection - one connection reaches many linked accounts across providers, so a single endpoint covers Workday, Slack and GitHub together instead of one connection per provider.
• Paste-a-URL setup - the MCP URL is the whole configuration for most clients, and the flow starts from the client rather than from anything you register up front.
• Per-action scoping - expand an account to list its actions with descriptions and categories, then turn off what the client should not have. The count in the account header tracks the selection and the footer totals what is about to be granted.
• Advanced Tool Search - a toggle on the consent screen swaps the full tool list for one search tool and one execute tool, which cuts the context a large action set costs on every turn. Admins can settle it project-wide under Project Settings → MCP Settings instead of leaving it to whoever authorizes.
• Link an account mid-flow - Link Account opens account linking inside the consent screen, and the new account is immediately selectable.
• Per-user grants and revocation - every authorization belongs to the person who approved it rather than to a project API key. Revoking it under Connected Apps stops that client’s tool calls without unlinking the account.
• Member-scoped access - a user provisioned as a Member only sees the organizations, projects and accounts they already have access to, which is what makes one published URL safe.

Connecting a client

Adding the URL is usually the whole setup. Most clients work out on their own that the server wants OAuth and register themselves through dynamic client registration, so there is nothing to set up in advance.

A few clients sign in from a fixed hosted address and cannot register themselves. Those need a client ID and secret created under Project Settings → MCP OAuth Clients first.

Agent Setup has the steps for all major clients, and any client that speaks the Streamable HTTP transport and supports OAuth can connect.