What’s actually changing, and why
The specification changelog states the change directly:
“OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) deprecated in favor of Client ID Metadata Documents”
DCR’s real weakness: an authorization server minting a client_id for any client that asks doesn’t provide a reliable way to verify who’s actually asking, which makes it vulnerable to phishing-style client impersonation. CIMD flips the identity model to be web-based instead: if a client controls the domain hosting its metadata document, it controls its own identity, verified by the authorization server fetching that URL directly rather than trusting a self-reported registration.
Structural Comparison Matrix
| Operational Aspect | OAuth DCR (deprecated) | Client ID Metadata Documents |
|---|---|---|
Where client_id comes from | Minted by the authorization server at registration | The client’s own stable HTTPS metadata URL |
| Identity verification | Self-reported at registration time | Verified by fetching the client-controlled URL |
| Hosting requirement | None, beyond the registration call | Client must host a JSON document at a stable URL |
| Pre-registration needed | No, that’s the point of DCR | No, CIMD is also stateless in this sense |
Fix it: host a metadata document, use its URL as client_id
{
"client_name": "Example MCP Client",
"redirect_uris": ["https://client.example.com/oauth/callback"],
"grant_types": ["authorization_code"],
"token_endpoint_auth_method": "none"
}The URL where this document is hosted, for example https://client.example.com/.well-known/oauth-client, is what gets used as the client_id in authorization requests, not an ID returned by a registration call. This is a genuine architecture change for any client currently calling a DCR registration endpoint at startup: that call, and whatever code stores the resulting minted client_id, gets replaced by hosting a static document and referencing its own URL.
DCR still works, this isn't a hard break yet
Dynamic Client Registration continues to function for backward compatibility per the specification’s deprecated features registry, so an existing DCR-based integration isn’t broken today. Treat this as a signal to plan the CIMD migration, not an emergency fix, unless you’re building new client integrations, where CIMD should be the default from the start.
Confirmed version
Sourced from the official Model Context Protocol specification changelog, 2026-07-28 revision, published 2026-07-28, and independent sourcing on the Client ID Metadata Documents mechanism (SEP-991) for the concrete hosting and verification model. Browse more posts like this in the AI Productivity archive.
