Comment by erebe__
10 hours ago
We had the same issue with the client_id and for security reason we weren't willing to enable DCR.
What we ended up doing, was the app proxying the OAuth flow, to inject a hardcoded client_id. So we lie to the MCP client telling it we support DCR while behind the hood we use a standalone client_id as usual for the MCP.
If you want to take example at it https://gist.github.com/erebe/a5de36d42214721b2466fb0e66f61c...
Depending on the setup, you just have to be really careful to avoid confused deputy scenarios.
I wrote about it: https://den.dev/blog/mcp-confused-deputy-api-management/