I wrote a much more narrative version of what this is useful for here: https://aaronparecki.com/2025/05/12/27/enterprise-ready-mcp

It isn't exclusive to MCP, it applies to any regular OAuth connection between apps under the same enterprise IdP too, but MCP is a topical example at the moment.