No client registration mechanism advertised

What it means

An MCP client needs a client_id before it can start the OAuth flow. The MCP authorization spec (2026-07-28) names three ways to get one: Client ID Metadata Documents, pre-registration and Dynamic Client Registration (RFC 7591). Metadata documents are the recommended route. Dynamic registration is deprecated but still allowed. This finding is high when the server metadata advertises neither "client_id_metadata_document_supported": true nor a "registration_endpoint". Third party clients then have no automatic way in and every one of them has to be registered by hand. If the server only offers dynamic registration the finding is reported at info level and does not affect the grade. A server that supports metadata documents passes.

How to fix

Support Client ID Metadata Documents and advertise "client_id_metadata_document_supported": true in authorization server metadata. For older clients also expose a Dynamic Client Registration endpoint (RFC 7591): POST /register accepts client metadata and returns a client_id. Advertise it as "registration_endpoint".

Spec

Background