From DCR to CIMD: MCP Client Identity in Production

AGNTCon + MCPCon North America 2026

Oct 22, 2026 · 10:55–11:20 · America/Los_Angeles

MCP's authorization spec now points implementers to Client ID Metadata Documents (CIMD) as the preferred path when clients and servers have no prior relationship, with Dynamic Client Registration (DCR) as fallback. That shift changes how client identity is created, verified, rotated, cached, and audited. For server authors, gateway operators, and client platform teams running auth across many providers. We unpack the spec change, show how CIMD fits the OAuth handshake, and map the open production problems: redirect URI trust, SSRF hardening, metadata caching, key rotation, revocation, and tenant isolation. DCR creates operational pressure at scale: registration sprawl, stale records, tenant drift, unclear ownership. CIMD replaces much of that with stable HTTPS client identifiers backed by URL-resolved metadata. Grounded in running an MCP gateway, we walk through a migration matrix across DCR, pre-registration, and CIMD; a pattern for translating identity across heterogeneous servers; and an audit model preserving attribution from human to agent to tool to API. Attendees leave with a model of MCP client identity in 2026, a decision tree for registration, and a checklist.

Session status: scheduled

Room: LL20 AB

Track: MCPCon

Level: Intermediate

Official session / agenda

Saving a session is not registration. Check the official agenda for availability, eligibility and any additional fees.

Speakers and their event affiliations

Parent event

In person · San Jose McEnery Convention Center, San Jose, California, United States

This describes the parent event. Confirm the session’s attendance requirements with the organizer.

Companies participating in the parent event

These are event-level relationships, not confirmed sponsorship of this session.

Showing 24 of 512 company relationships. View all on the event page.