What is the difference between Dynamic Client Registration and Client ID Metadata Documents for MCP clients?

Why This Matters for Security Teams

For MCP deployments, the choice between dynamic client registration and client id metadata document is not just a protocol preference. It changes who can create clients, how identity is anchored, and whether a server can trust a client across environments. In practice, DCR favors controlled onboarding inside a known boundary, while CIMD supports portable client identity when multiple authorization servers need to read the same metadata. That matters because agentic and tool-driven clients rarely stay static for long.

Security teams often underestimate how quickly MCP client identity becomes part of a larger NHI governance problem. If a client can register itself at runtime, the operational question becomes who is allowed to create that identity and what policy applies before registration succeeds. If the client is identified by a HTTPS metadata document, the challenge shifts to availability, authenticity, and version control of that document. The distinction is especially important in environments already tracking agent risk in the AI Agents: The New Attack Surface report, where autonomous systems can move faster than manual review cycles.

Current guidance in the OWASP Agentic AI Top 10 also reinforces that identity plumbing is part of attack surface reduction, not just developer convenience. In practice, many security teams encounter identity sprawl only after an agent or MCP client has already been deployed across multiple environments.

How It Works in Practice

Dynamic Client Registration creates a client identity at runtime by sending registration data to the authorization server. That is useful when the server controls onboarding, wants to issue its own client identifier, and can enforce policy before the client is accepted. It works best for closed deployments, internal tools, and situations where the authorization server is the system of record for client identity.

client id Metadata Documents take the opposite approach. The client hosts a HTTPS metadata document, and that URL becomes the client identifier. The authorization server fetches the document on demand to learn the client’s redirect URIs, contacts, and other registration details. This is useful when the same client identity must be recognized across multiple authorization servers, or when the client should remain portable without re-registering everywhere. The OWASP Top 10 for Agentic Applications 2026 and NHIMG’s Ultimate Guide to NHIs both point to the same operational reality: identity has to be traceable, governable, and resilient across tool chains.

• Use DCR when the authorization server should approve each new client directly.
• Use CIMD when client identity must be stable and reusable across servers.
• Validate HTTPS, document integrity, and ownership for CIMD before trusting metadata.
• Treat registration policy as a control plane issue, not just a developer workflow.
• Track client lifecycle events so old identities are not left active after migrations.

The security tradeoff is that DCR centralizes trust but can create registration sprawl, while CIMD improves portability but depends on the integrity and reachability of an external document. These controls tend to break down when client metadata is hosted in unstable environments or when authorization servers cannot reliably verify the origin of the HTTPS document.

Common Variations and Edge Cases

Tighter client identity controls often increase operational overhead, requiring organisations to balance portability against governance. There is no universal standard for this yet, so the right choice depends on whether the MCP client is a tightly managed internal workload or a distributed identity that must survive across authorization domains.

One common edge case is migration. A team may begin with DCR during internal testing, then later need CIMD because the same MCP client must authenticate against multiple servers. Another is delegated administration: if different business units can manage their own client metadata, CIMD can reduce duplication but also create consistency problems unless document ownership is clearly controlled. A third issue is change management. If metadata documents are updated without version discipline, authorization servers may see a client as one thing at onboarding and another thing at runtime.

For NHI-heavy environments, the practical lesson is to align the registration method with the trust model. DCR fits environments where access is issued, reviewed, and revoked centrally. CIMD fits environments where identity needs to be portable, externally readable, and less dependent on a single registration event. That distinction is consistent with NHIMG’s research on MCP exposure in the The State of MCP Server Security 2025, which shows how quickly weak control surfaces can accumulate in real deployments.

Related resources from NHI Mgmt Group

• Should organisations keep dynamic client registration enabled for older MCP clients?
• How should security teams implement Client ID Metadata Documents?
• What is the difference between client identity and permission scope in MCP governance?
• How should security teams handle Dynamic Client Registration in remote MCP deployments?