Securing Dynamic Client Registration (DCR) from Abuse in OAuth for MCP Server

Discussions
1

I am looking for a reliable way to secure Dynamic Client Registration (DCR) to prevent malicious users from creating unauthorized clients on my IdentityServer. We’re currently exposing DCR as part of our OAuth setup for securing access to our MCP server and allowing MCP clients like Cursor and Claude to use it for authenticating users.

My concern is how to prevent abuse of the DCR endpoint, especially from anonymous or untrusted sources. Has anyone implemented a secure pattern for DCR in a production environment?

I would appreciate insights into:

  • Any best practices.
  • Whether it makes sense to completely disable DCR in favor of manual registration for MCP clients like cursor or claude.

Thanks in advance for any guidance or examples you can share!

1 Like
2

There is a SEP about client registgration (SEP-007: Enable URL-based Client Registration using OAuth Client ID Metadata Documents · Issue #991 · modelcontextprotocol/modelcontextprotocol · GitHub), client ID metadata looks is promising - Authorization Server only needs to maintain a list of known client ID metadata URLs and return the same client ID.