Revision diff

What changed from 2025-11-25 to 2026-07-28

Deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation on authorization responses, keys stored client credentials by issuer, requires application_type on DCR requests, and removes session identifiers from the transport. Splits the authorization text into separate pages for discovery, client registration and security considerations.

Read 2025-11-25 ·Read 2026-07-28 ·23 features unchanged

Level changed 1

Dynamic Client Registration offeredSHOULDtoMAYmcp.as.dcr · Authorization server · Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents. · Client Registration › Dynamic Client Registration

Added in 2026-07-28 5

Issuer identifier in authorization responsesSHOULDmcp.as.iss-param · Authorization server · Authorization › Authorization Response Validation
Credentials stored per issuerMUSTmcp.client.credentials-keyed-by-issuer · Client · Client Registration › Credential Storage
application_type on DCR requestsMUSTmcp.client.dcr-application-type · Client · Client Registration › Dynamic Client Registration
Exact iss comparisonMUSTmcp.client.iss-compare-no-normalization · Client · Authorization › Authorization Response Validation
No offline_access in advertised scopesSHOULDmcp.prm.no-offline-access · MCP server · Authorization › Refresh Tokens

Removed since 2025-11-25 0

Nothing was removed.