MCPP-CIMD52: Required client metadata missing¶
| Family | Client ID Metadata Documents |
| Default severity | medium |
| Confidence | high |
| Mode | mcp-posture cimd lint only |
| Spec revisions | 2025-11-25 and later |
Why it matters¶
MCP requires client_id, client_name and redirect_uris in the document; authorization servers display client_name on consent and validate redirect_uri against redirect_uris.
Remediation¶
Add a human-readable client_name and a non-empty redirect_uris array.
References¶
- MCP 2026-07-28 Client Registration
- OAuth Client ID Metadata Document (draft-ietf-oauth-client-id-metadata-document-02)
Suppressing¶
# .mcp-posture-ignore
[[ignore]]
check = "MCPP-CIMD52"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31