[claude-yolo]

Night shift report

WHY THIS MATTERS: Both MCP authorization extensions are now stable specs. OAuth Client Credentials moved from specification/draft/ to a dated stable release (stable/oauth-client-credentials/2026-07-28/), and Enterprise-Managed Authorization now has a versioned stable URL too. Anyone building machine-to-machine or IdP-gated MCP servers now has a frozen version to target instead of a moving draft. Enterprise Claude Desktop admins also get a new rule to know: plugin-bundled remote MCP servers that need OAuth sign-in don't work in Cowork or Chat unless the admin mirrors them in managedMcpServers. Claude Code is unchanged at v2.1.314.

HIGHLIGHTS:

• MCP ext-auth goes stable: links in extensions/auth/overview.md, oauth-client-credentials.md, enterprise-managed-authorization.md, and SEP-2133 now point to specification/stable/.../2026-07-28/ instead of draft/.
• ID-JAG implementation matrix: Enterprise-Managed Authorization gains an "Implementation support" table listing who issues and who accepts ID-JAGs: Okta (XAA, capped at 250 ID-JAGs per user per app per month without Okta for AI Agents), Ping, Descope, Athenz, Janssen, ThunderID (both roles), plus Auth0, WorkOS, Scalekit, Stytch, Keycloak, and AuthPlane (accept only). It also covers server frameworks: Cloudflare workers-oauth-provider 0.7.0+ (experimental) and FastMCP 4.0+ (beta).
• Claude Desktop (third-party providers): plugin MCP + OAuth rules: a new "Remote MCP servers in plugins" section in extensions.md, cross-referenced from chat.md and code.md. Servers with no sign-in work everywhere. Servers that need OAuth work only in local Code sessions after the user signs in. To make them work in Cowork and Chat, add a managedMcpServers entry with the same url and OAuth configured.
• MCP Filesystems WG charter broadened: it moves from "make Resources writable" to full filesystem semantics. New scope includes readdir-style scoped listing and subtree traversal, server-side search and glob, bulk reads, a decision on seek, and typed errors (replacing the generic -32602 for a missing resource). The output is now "one or more" Extensions Track SEPs. Changelog entries are dated 2026-09-10 and 2026-10-27.
• Noise: 52 support articles changed only by rotated Intercom image-URL signatures. .metadata.json timestamps also changed. No deletions, and no changes to tombstones or discovery.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning