IETF · July 2015
RFC 7591
J. Richer, M. Jones, J. Bradley, M. Machulak, P. Hunt
OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591) is RFC, July 2015. An agent that discovers a new MCP server at runtime historically called DCR. That is why the ecosystem is moving to URL-as-client_id (CIMD) and why AAuth skips client registration entirely in favor of a published agent key.
At a glance
Actors
01
Clients that did not exist at AS-configuration time need a client_id without a human filling out a developer portal. RFC 7591 is how mobile apps and, later, MCP clients minted one at runtime. Open registration without software statements is an abuse magnet — spam clients, secret leakage, no lifecycle.
MCP 2026-07-28 deprecates DCR as the preferred mechanism in favor of CIMD, keeping DCR as a MAY for old servers. AAuth skips client registration entirely in favor of a published agent key.
02
The registration endpoint is a provisioning plane. An open endpoint lets anyone become a client. Software statements (signed metadata) and initial access tokens are how you close it. client_secret in an agent host is a liability.
03
POST a metadata document to the registration endpoint. AS returns client_id, optional client_secret, and registered metadata. RFC 7592 (management) is optional. MCP requires that credentials obtained via DCR are bound to that AS issuer and not reused if PRM points at a new AS.
04
Flow 1
Client discovers registration_endpoint from RFC 8414 metadata.
POSTs redirect_uris, client_name, token_endpoint_auth_method, jwks, …
Stores client_id (and secret if any) keyed by AS issuer.
Proceeds with authorization code + PKCE.
05
Client identity provisioning. Issues a client_id; not user identity. Not authorization of APIs.
06
Evolutionary replacement for open-world clients: URL as client_id, no handshake.
DCR MAY, deprecated. CIMD SHOULD.
AAuth's answer to the same pain is to stop issuing AS-local client_ids.
Discovers the registration endpoint.
07
Botnets will register. Require software statements or CIMD instead.
MCP explicitly forbids reusing DCR credentials when the AS changes. Mix-up adjacent.
08
RFC 7591, July 2015. Stable RFC, politically deprecated for MCP-like open-world clients in favor of CIMD. https://www.rfc-editor.org/rfc/rfc7591.html
MCP 2026-07-28 deprecates DCR as the preferred mechanism in favor of Client ID Metadata Documents, keeping DCR as a MAY for old servers. Open registration without software statements is an abuse magnet.
Deployment patterns
Compare