---
title: "Register MCP clients with Client ID · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/mcp-servers/client-id-metadata-documents
id: AGT-13
level: Recommended
updated: 2026-10-22
tokens: 1112
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Register MCP clients with Client ID Metadata Documents

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [MCP servers](https://agentwranglers.se/playbook/agents-as-users/mcp-servers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: AGT-13
- Level: Recommended
- Chapter: [MCP servers](https://agentwranglers.se/playbook/agents-as-users/mcp-servers.md)
- Rule: Let MCP clients you have never met use an HTTPS address as their client ID. Fetch the metadata document there and check it, instead of open dynamic registration.
- Check: Authorization server metadata shows `client_id_metadata_document_supported: true`. A test client whose document has a different `client_id`, and one asking for a `redirect_uri` not in its list, both get `invalid_client` or `invalid_request`. A valid document gets a code.
- How: The 2026-07-28 revision deprecates dynamic client registration in favour of Client ID Metadata Documents. Advertise `client_id_metadata_document_supported: true` in your authorization server metadata. On a URL-shaped `client_id`, fetch the document as [Fetch key directories with network limits](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/safe-key-directory-fetch.md) says. Refuse it unless its `client_id` equals the address exactly and it lists `client_name` and `redirect_uris`. Accept only a `redirect_uri` from that list. Cache it by its HTTP cache headers. Keep dynamic registration only for older clients, with a rate limit. Show the client's host on consent, as [Name the agent on the consent screen](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/agent-on-consent-screen.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "client_id": "https://assistant.example.net/oauth/client.json",
  "client_name": "Example Assistant",
  "client_uri": "https://assistant.example.net",
  "redirect_uris": ["https://assistant.example.net/oauth/callback"],
  "grant_types": ["authorization_code"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}
```

### JavaScript example

```js
export function checkClientDocument(clientIdUrl, doc, redirectUri) {
  if (doc.client_id !== clientIdUrl || !doc.client_name || !Array.isArray(doc.redirect_uris)) return 'invalid_client';
  return doc.redirect_uris.includes(redirectUri) ? null : 'invalid_request';
}
```

### Python example

```python
def check_client_document(client_id_url: str, doc: dict, redirect_uri: str) -> str | None:
    if doc.get("client_id") != client_id_url or not doc.get("client_name") or not isinstance(doc.get("redirect_uris"), list):
        return "invalid_client"
    return None if redirect_uri in doc["redirect_uris"] else "invalid_request"
```

## Sources

- [MCP client registration](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration)
- [IETF draft (OAuth Client ID Metadata Document)](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/)

## Related rules

- AGT-2 [Fetch key directories with network limits](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/safe-key-directory-fetch.md) in Agents as users
- AGT-8 [Name the agent on the consent screen](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/agent-on-consent-screen.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/mcp-servers/client-id-metadata-documents">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check the caller's rights on every handle](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/check-handle-owner.md)
- Next: [Reject MCP requests whose headers disagree with the body](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/mcp-header-validation.md)
- [MCP servers](https://agentwranglers.se/playbook/agents-as-users/mcp-servers.md)