MCP-AUT-011

AS supports Client ID Metadata Documents, not DCR alone

“Authorization servers and MCP clients SHOULD support OAuth Client ID Metadata Documents. Dynamic Client Registration is deprecated and retained for backwards compatibility.” — spec anchor

How to fix this

Advertise `client_id_metadata_document_supported` on the authorization server. Dynamic Client Registration is deprecated and retained only for backwards compatibility.

Example: failing and passing

The authorization server offers only Dynamic Client Registration, which the spec deprecates, and does not advertise Client ID Metadata Document support.

Violates MCP-AUT-011 · JSON

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "response_types_supported": ["code"],
  "code_challenge_methods_supported": ["S256"],
  "registration_endpoint": "https://auth.example.com/register"
}

The metadata sets client_id_metadata_document_supported to true, so clients can use an HTTPS URL as their client_id; DCR can stay for older clients.

Complies with MCP-AUT-011 · JSON

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "response_types_supported": ["code"],
  "code_challenge_methods_supported": ["S256"],
  "registration_endpoint": "https://auth.example.com/register",
  "client_id_metadata_document_supported": true
}

How the validator checks this

Probe P8.3, against a streamable-http server on the modern protocol. What it reports:

pass: Every authorization server supports OAuth Client ID Metadata Documents
warn: Does not advertise client_id_metadata_document_supported: …. Dynamic Client Registration is deprecated and retained only for backwards compatibility.

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-004, MCP-AUT-005, MCP-AUT-010.

Check your own server against MCP-AUT-011

Probe P8.3 checks MCP-AUT-011 in the same request as 3 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: how to add OAuth to an MCP server.

Other Authorization rules

MCP-AUT-001Unauthenticated request returns 401 with WWW-Authenticate resource_metadata
MCP-AUT-002RFC 9728 Protected Resource Metadata is served and valid
MCP-AUT-003PRM resource equals the canonical server URI
MCP-AUT-004Each listed authorization server exposes RFC 8414 or OIDC discovery metadata
MCP-AUT-005AS advertises authorization_response_iss_parameter_supported: true
MCP-AUT-006WWW-Authenticate includes a scope parameter
MCP-AUT-007Insufficient scope returns 403 with error="insufficient_scope"
MCP-AUT-008Tokens with a foreign audience are rejected
MCP-AUT-009offline_access absent from scopes_supported / challenge scope
MCP-AUT-010AS advertises S256 in code_challenge_methods_supported