Client ID Metadata Documents (CIMD)
In short:Client ID Metadata Documents let an OAuth client use a URL as its client ID. The authorization server fetches a JSON document at that URL to learn about the client. The 2026-07-28 MCP specification made CIMD the registration method, replacing Dynamic Client Registration.
What is it?
The client ID is an HTTPS URL the client controls. The document there lists the client name, redirect URIs and keys.
The authorization server fetches and caches it, so no registration call is needed.
Why do agents need it?
Dynamic Client Registration let anyone create clients, which filled servers with unknown registrations. CIMD ties each client to a domain someone owns.
For agents, that gives each MCP client a verifiable identity before any token is issued.
Which scored platforms name it?
Other scored platforms: not found in public material read on 3 November 2026.
Other standards
- OAuth 2.1
- MCP authorization
- Enterprise-Managed Authorization (Cross App Access, ID-JAG)
- SPIFFE
- DPoP and mTLS
- CIBA (human approval)
- OAuth token exchange (RFC 8693)
Sources
- [mcp-0728] MCP specification 2026-07-28. https://blog.modelcontextprotocol.io/posts/2026-07-28/. Read .
- [ds-hub3] Descope Agentic Identity Hub 3.0. https://www.descope.com/blog/post/agentic-identity-hub-3. Read .