Build a Secure C# MCP App with Cross App Access (XAA)

Summary

Cross App Access (XAA) addresses the gap between a user’s authenticated identity and a downstream MCP server, API, or agent tool that must trust that identity without another login. The described flow uses OIDC and PKCE for sign-in, then RFC 8693 token exchange to turn the ID token into a JWT Authorization Grant (JAG), followed by RFC 7523 exchange at the MCP authorization server for a scoped bearer token. A C# MCP SDK IdentityAssertionGrantProvider encapsulates both exchanges, while ASP.NET Core OIDC middleware persists the ID token and an HTTP transport presents the resulting token to the MCP server. The sample connects to a Todo resource through the xaa.dev playground, completes MCP initialization, lists resources, and reads todo0://todos; the article states that the end-to-end implementation fits in under 50 lines of C#.

Takeaways

1. 1

   XAA uses RFC 8693 to obtain a JWT Authorization Grant from the enterprise identity provider and RFC 7523 to exchange that grant for a scoped MCP access token.

2. 2

   Setting MapInboundClaims to false prevents ASP.NET Core from remapping standard OIDC claim names to legacy WS-Federation names.

3. 3

   McpClient.CreateAsync performs the MCP initialization handshake before the sample lists resources and reads todo0://todos from the Todo resource server.