MCP Auth Without DCR: Ship a CIMD Client Document

On 22 August the MCP core maintainers published a new roadmap, and one of its five priority areas is agent identity and enterprise-ready security. That roadmap sits on top of the 2026-07-28 spec release, which quietly did something a lot of teams have not noticed yet: it formally deprecated Dynamic Client Registration.

If your MCP client still calls a /register endpoint to get a client_id, you are on the deprecated path. The replacement is CIMD, Client ID Metadata Documents, and the idea is almost aggressively simple: you host a small JSON file at an HTTPS URL, and that URL becomes your client_id. No registration call, no stored secret, no coordination with the server operator.