Vercel MCP now supports Client ID Metadata Documents for OAuth connections

What changed

Vercel MCP now accepts Client ID Metadata Documents (CIMD) as OAuth client IDs, eliminating the requirement for Vercel to manually review and allowlist each client before it can connect. Previously, any MCP client attempting to connect had to be reviewed by Vercel first, with its redirect URIs added to an allowlist. Clients not on that list were rejected outright.

The new approach follows the MCP authorization specification, which now recommends CIMD over Dynamic Client Registration. To connect, a client publishes a CIMD—a JSON file hosted on its own domain that describes the client—and uses that file's HTTPS URL as its OAuth client_id. This shift enables any MCP client to initiate a connection request without prior coordination with Vercel.

What you see when connecting

Because Vercel has not reviewed these CIMD-based clients, the OAuth consent screen now displays transparency information to help users make informed decisions. The screen shows the client's name, its logo, and the hostname serving its metadata document. For example, a connection request might display as "Claude Code by claude.ai", making it clear where the client originates.

Critically, CIMD clients do not receive the Vercel verified badge that pre-registered clients carry. This means the hostname—the domain serving the metadata document—becomes the key identifier users are trusting when they approve access. Users can verify the hostname matches the legitimate service before granting permissions.

Who it affects

This change impacts developers building or deploying MCP clients that integrate with Vercel. Any client can now connect without waiting for Vercel's review process. This includes coding agents, development tools, and third-party services that rely on MCP to interact with Vercel accounts.

Applications that were already registered with Vercel prior to this change remain unaffected and continue to operate under their existing pre-registration status.

How to connect your client

To integrate an MCP client with Vercel using CIMD, you must first publish a Client ID Metadata Document on your client's domain. This JSON file should describe your client and be accessible via HTTPS. You then use the HTTPS URL of this metadata file as your OAuth client_id when initiating the connection to Vercel.

When a user attempts to connect your client to their Vercel account, they will see the consent screen displaying your client's name, logo, and the hostname serving your metadata document. Users retain full control—they must log in and explicitly approve each connection. After approval, your client gains access to the user's Vercel account with the permissions specified in the authorization request.

Implementation details

The CIMD approach aligns with evolving OAuth best practices by moving away from pre-registration workflows toward metadata-driven discovery. Instead of maintaining a centralized allowlist, Vercel now validates connections at request time by reading the metadata document from the URL provided as the client_id. This reduces friction for client developers while maintaining user consent and transparency through the consent screen.

The consent screen provides users with enough information to identify and verify clients they trust. The absence of a verified badge for CIMD clients is intentional—it signals to users that they should verify the hostname and client details match a legitimate service before granting access.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.