DCR
The Dynamic Client Registration specification in the OAuth ecosystem (RFC 7591), which allows a client to register with an authorization server at runtime and obtain a client_id and client_secret without manual pre-configuration. It is used in multi-tenant SaaS or open ecosystems for self-service third-party application onboarding.
Timeline (last 90 days)
The specification corresponding to DCR (Dynamic Client Registration) is RFC 7591; after the client sends a POST request to the authorization server's registration endpoint, the server returns a client ID and client secret.
Using DCR in MCP scenarios has drawbacks including Client ID proliferation, lack of validation, secret management burden, and scenario mismatch.
The MCP specification wording indicates that DCR may be used, but CIMD should be used where possible.
DCR is best suited for long-lived clients, while CIMD is best suited for ephemeral temporary agents and MCP client-server scenarios.
In Sam Welland's demo, DCR generates a new application on the authorization server over and over again upon repeated disconnections and reconnections, whereas CIMD always reuses the same application.
All Facts (5)
The specification corresponding to DCR (Dynamic Client Registration) is RFC 7591; after the client sends a POST request to the authorization server's registration endpoint, the server returns a client ID and client secret.
50%UnverifiedUsing DCR in MCP scenarios has drawbacks including Client ID proliferation, lack of validation, secret management burden, and scenario mismatch.
50%UnverifiedThe MCP specification wording indicates that DCR may be used, but CIMD should be used where possible.
50%UnverifiedDCR is best suited for long-lived clients, while CIMD is best suited for ephemeral temporary agents and MCP client-server scenarios.
50%UnverifiedIn Sam Welland's demo, DCR generates a new application on the authorization server over and over again upon repeated disconnections and reconnections, whereas CIMD always reuses the same application.
50%