%%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#1f1f1f', 'primaryTextColor': '#ffffff', 'primaryBorderColor': '#ffffff', 'lineColor': '#ffffff' }}}%% sequenceDiagram participant UA as Web Browser participant Client as MCP Client participant BFF as MCP Server participant Auth as Identity Provider participant Backend as Protected API Client->>BFF: Initial request BFF-->>Client: 401 Unauthorized Client->>BFF: /authorize BFF->>BFF: Generate session ID BFF-->>Client: Redirect to IdP authorization endpoint Client-->>UA: Open authorization endpoint UA->>BFF: Redirect after authenticating the user BFF->>Auth: Exchange the authorization code for token Auth-->>BFF: Access token BFF->>BFF: Cache token along with session ID BFF-->>Client: Return JWT with session and metadata…