MCPP-ASM09: Dynamic Client Registration endpoint exposed

Family	Authorization Server Metadata (RFC 8414 / OIDC)
Default severity	info
Confidence	high
Mode	passive (default scan)
Spec revisions	all

Why it matters

Anonymous DCR lets anyone create clients (with arbitrary names, logos and redirect URIs) that users will see on consent screens. It is allowed but worth knowing, especially since 2026-07-28 deprecates DCR for MCP.

Remediation

If DCR is not needed, disable it. Otherwise rate-limit it, require an initial access token where possible, and show the redirect hostname on consent.

References

• RFC 7591 Dynamic Client Registration
• MCP 2026-07-28 Client Registration

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-ASM09"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31