MCP auth: Stop registering, Start linking
summary
Shows that Dynamic Client Registration creates runaway client-id sprawl while Client ID Metadata Documents turn the client_id into an HTTPS URL the server fetches on demand, removing per-server secrets and state. Demo uses MCP Inspector, a local MCP server and an auth server, swapping a /register DCR flow that creates new records each run for a single client.json URL against a client ID as HTTPS URL that the auth server validates; outcome: no server-side storage, stateless identity that works end to end.
AI-written summary · about
chapters (14)
- 0:00MCP auth shift intro
- 1:04OAuth needs client ID
- 2:09Dynamic client registration
- 3:53Problems with dynamic client registration
- 5:36Client ID metadata docs
- 7:04How CIMD works
- 8:49DCR vs CIMD
- 10:17Demo: DCR in action
- 11:43Demo: CIMD in action
- 13:57Why CIMD preferred
- 14:38When to use DCR
- 15:21Future of client ID metadata documents
- 15:42MCP auth complete
- 16:04Resources
related talks
25mYour Insecure MCP Server Won't Survive Production
17mSponsored Demo: MCP Auth Demo: CIMD With Keycloak
23mIdentity Best Practices to Secure & Scale Agentic AI / MCP Deployments
14m(possible dupe but better sound) What does Enterprise Ready MCP mean?
29mMCP in 2026: Context is All You Need
25mAre MCP Servers Dead?
26mWho Let the Agent In? Securing MCP Servers in Production
47mMCP Demystified: Cutting Through the Hype-What It Is, What Isn't & Its Role in the Agentic RAG Stack