News · Model Context Protocol · 2 min read
Event date: · Published:
MCP spec deprecates Dynamic Client Registration for OAuth clients
The Model Context Protocol project reworked its authorization guide on November 8, 2026, making Client ID Metadata Documents the primary registration method and marking Dynamic Client Registration deprecated.
The Model Context Protocol project merged a reworked authorization guide on November 8, 2026, replacing Dynamic Client Registration with Client ID Metadata Documents as the primary way MCP OAuth clients register. The change shipped in PR #3518, which restructured the guide for the 2026-07-28 spec version.
Concrete changes to the authorization guide
- Client ID Metadata Documents become the primary registration method for MCP OAuth clients.
- Dynamic Client Registration is now marked deprecated in the reworked guide.
- Vendor-specific examples were replaced with provider-agnostic requirements, and TypeScript, Python and C# code samples moved to the v2 SDKs.
- The guide adds stricter validation requirements for audience, issuer, scope and Origin header checks, with tolerance for minor clock skew.
- A companion PR #3521, merged November 9, 2026, updated references to the IETF OAuth Client ID Metadata Document draft 03, published November 2, 2026.
- PR #3514, merged November 8, 2026, codified a new contribution policy requiring working-group approval of SEP proposals before a spec pull request can open, limiting direct spec PRs to organization members.
What it means for people building with AI
Anyone building OAuth-based authentication for MCP servers needs to move off Dynamic Client Registration toward Client ID Metadata Documents, since the reworked guide marks DCR deprecated. The new SEP approval requirement also changes how developers can propose changes to the protocol itself: a working group must approve a SEP proposal before a spec pull request can even open, and direct spec PRs are now limited to organization members.
Other documentation changes
A separate pull request, PR #3466, merged November 8, 2026, repointed documentation links for the Skills extension from specification/stable/ to specification/beta/, since that extension remains in Beta under SEP-3392.
Sources
- Rework authorization guide for 2026-07-28 spec (PR #3518) (Model Context Protocol (GitHub), November 8, 2026, official)
- Update Client ID Metadata Document references (PR #3521) (Model Context Protocol (GitHub), November 9, 2026, official)
- Codify working-group SEP approval contribution policy (PR #3514) (Model Context Protocol (GitHub), November 8, 2026, official)
Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.