Should MCP clients use CIMD or Dynamic Client Registration?
In short: Use CIMD. The 2026-07-28 MCP specification deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. With CIMD, a client's ID is a URL that hosts its metadata, so authorization servers need no registration endpoint. DCR still works for now but will be removed in a later version.
How does Dynamic Client Registration work?
The client calls a registration endpoint on the authorization server and receives a client ID. Every server sees a stream of anonymous registrations it cannot verify.
How does CIMD work?
The client ID is an HTTPS URL. The authorization server fetches that URL to read the client's name, redirect URIs and other metadata.
Trust follows the domain, so an admin can allow or block clients by origin.
What should a gateway support?
A gateway that acts as an authorization server should accept CIMD client IDs. A gateway that only supports DCR still works today but scores lower on our standards criterion.
Sources
- MCP blog: 2026-07-28 release [mcp-0728] read 2026-11-03
- MCP spec: Authorization [mcp-auth] read 2026-11-03
Other explainers are listed on the spec hub.
By The Datasheet desk · Published and reviewed 2026-11-03