A comprehensive solution for

1. A user interacting with multiple MCP servers, behind a gateway (with MCP client support) to get authentication from the user to those servers in some way (OAuth/OIDC, with PKCE, usually, sometimes token exchange), allowing out-of-band auth

2. The same, but built on identity for service accounts/native identity or something, for automation

would enable this. There’s a few SEPs open now around this.