Register MCP clients with Client ID Metadata Documents

How to do it

The 2026-07-28 revision deprecates dynamic client registration in favour of Client ID Metadata Documents. Advertise client_id_metadata_document_supported: true in your authorization server metadata. On a URL-shaped client_id, fetch the document as Fetch key directories with network limits says. Refuse it unless its client_id equals the address exactly and it lists client_name and redirect_uris. Accept only a redirect_uri from that list. Cache it by its HTTP cache headers. Keep dynamic registration only for older clients, with a rate limit. Show the client's host on consent, as Name the agent on the consent screen says.

Examples

JSON example

{
  "client_id": "https://assistant.example.net/oauth/client.json",
  "client_name": "Example Assistant",
  "client_uri": "https://assistant.example.net",
  "redirect_uris": ["https://assistant.example.net/oauth/callback"],
  "grant_types": ["authorization_code"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}

JavaScript example

export function checkClientDocument(clientIdUrl, doc, redirectUri) {
  if (doc.client_id !== clientIdUrl || !doc.client_name || !Array.isArray(doc.redirect_uris)) return 'invalid_client';
  return doc.redirect_uris.includes(redirectUri) ? null : 'invalid_request';
}

Python example

def check_client_document(client_id_url: str, doc: dict, redirect_uri: str) -> str | None:
    if doc.get("client_id") != client_id_url or not doc.get("client_name") or not isinstance(doc.get("redirect_uris"), list):
        return "invalid_client"
    return None if redirect_uri in doc["redirect_uris"] else "invalid_request"

How to check

Authorization server metadata shows client_id_metadata_document_supported: true. A test client whose document has a different client_id, and one asking for a redirect_uri not in its list, both get invalid_client or invalid_request. A valid document gets a code.

Sources

• MCP client registration
• IETF draft (OAuth Client ID Metadata Document)

Related rules

• AGT-2 Fetch key directories with network limits in Agents as users
• AGT-8 Name the agent on the consent screen in Agents as users