Skip dynamic client registration option

[joberdick]

Pre-submission Checklist

• I have verified this would not be more appropriate as a feature request in a specific repository
• I have searched existing discussions to avoid duplicates

Your Idea

Currently, it seems that dynamic client registration is inherit in the auth spec. This causes issues for enterprises who need to maintain more control over their client registration process.

Some clients might allow a static override, but this does not seem to be in the spec. I am looking for something in the spec that offers a consistent way to override the dynamic registration.

This could be done with client side config and/or if servers omit the client registration endpoint, then clients would load the local clientid.

Scope

• Protocol Specification
• SDK Features
• Documentation
• Developer Experience
• Other

[dr3s]

Since protected resource metadata is extensible I opened modelcontextprotocol/modelcontextprotocol#573 to allow the MCP server to advertise public client ids

[localden]

This is, actually, somewhat covered in the spec (emphasis mine):

Any MCP authorization servers that do not support Dynamic Client Registration need to provide alternative ways to obtain a client ID (and, if applicable, client credentials). For one of these authorization servers, MCP clients will have to either:

1. Hardcode a client ID (and, if applicable, client credentials) specifically for the MCP client to use when interacting with that authorization server, or
2. Present a UI to users that allows them to enter these details, after registering an OAuth client themselves (e.g., through a configuration interface hosted by the server).

For AS that do not support DCR, the client needs to use a pre-baked ID (this is what Visual Studio Code does with Entra ID and GitHub) or provide an affordance for the user to provide their own client ID. Not saying this is ideal, but it's in the protocol definition.

[dr3s]

yep, I'm familiar. I just proposed an alternative that doesn't require hardcoding or client UI. I think if we're talking well known static public client ids, then the protected resource metadata might be a clean way to communicate them.