Skip to content
MCP Stateless Check

MCP020 — Authorization server offers only deprecated Dynamic Client Registration
Severity warning
Fixed by A change in your own server code
Transports http
Specification 2026-07-28
Changelog entry Deprecated 4

Why this changed

2026-07-28 deprecated OAuth 2.0 Dynamic Client Registration (RFC 7591) in favour of Client ID Metadata Documents: the client’s client_id is an HTTPS URL to a document describing it, so a client and a server with no prior relationship need no registration round trip at all. DCR still works through the deprecation window, but an authorization server offering it with no CIMD path leaves every new client on the mechanism being removed.

Only that combination is reported. An authorization server with neither relies on pre-registration, which is still a supported mechanism, and one that offers both is already migrated. Metadata inspection only, as MCP019.

Running just this check

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --only MCP020

Suppressing it

If this check does not apply to your server, skip it:

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --skip MCP020

Rule ids are permanent and are never reissued, so a suppression cannot start silently matching a different check later.

Generated from src/rules/MCP020.ts by scripts/gen-rule-docs.mjs. Edit the rule source, not this page.