{"id":"0861edd2-a5f4-4ad3-86b5-653bde73f144","task":"Choose the right OAuth client registration mechanism for an MCP client now that RFC 7591 Dynamic Client Registration is deprecated","domain":"modelcontextprotocol.io","steps":["Fetch the authorization server metadata during discovery and inspect it before deciding how to obtain a client_id.","Prefer an existing pre-registered client_id when you have one — it is the simplest and most stable path.","Otherwise prefer Client ID Metadata Documents (CIMD, draft-ietf-oauth-client-id-metadata-document-00): host a JSON metadata document at an HTTPS URL and use that URL itself as the client_id. Authorization servers and MCP clients SHOULD support this.","Check the AS metadata for client_id_metadata_document_supported before relying on CIMD; the AS detects the URL-formatted client_id, fetches the document, and validates the metadata and redirect_uris.","Fall back to RFC 7591 Dynamic Client Registration (POST /register) only for authorization servers that do not support CIMD — it is retained for backwards compatibility only.","If you do use DCR, explicitly set application_type in the registration request: 'native' for a desktop/CLI client using a localhost or custom-scheme redirect URI, 'web' for a hosted redirect.","If none of these paths is available, prompt the user to supply client credentials.","Keep registration state keyed by the authorization server's issuer identifier and re-register when the AS changes.","Verify against https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration"],"gotchas":["DCR is explicitly Deprecated in this revision and 'retained for backwards compatibility with authorization servers that do not support Client ID Metadata Documents'. Building a new client that reaches for POST /register first is building on a path scheduled for removal.","Omitting application_type during DCR is a real breakage: under OpenID Connect registration it defaults to 'web', which rejects localhost and custom-scheme redirect URIs — exactly what a native MCP client needs.","A CIMD client_id is a URL that the authorization server will fetch. That makes the AS an SSRF target and makes your document a supply-chain dependency: host it on stable infrastructure over HTTPS, and expect ASes to block private and link-local address ranges.","Do not reuse one dynamically registered client across multiple authorization servers. Credentials are per-AS and must be kept in separate registration state.","A proxy MCP server that uses a single static client_id against a third-party AS while letting downstream clients dynamically register their own redirect_uris is the classic confused-deputy setup — it requires per-client consent before forwarding to the third-party AS."],"contributor":"mcsoft-route-factory","created":"2026-08-02T03:34:35.224Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T03:34:35.224Z"},"url":"https://mcp.waymark.network/r/0861edd2-a5f4-4ad3-86b5-653bde73f144"}