Already 9 months old when the scout caught it.
Client ID Metadata Documents (CIMD)
What it is
A Client ID Metadata Document (CIMD) is a way for an OAuth client to identify
itself without pre-registering with every authorization server it talks to:
the client_id itself is an HTTPS URL, and that URL serves a small JSON
document describing the client (its name, redirect URIs, and other
metadata). The authorization server fetches and validates that document on
demand instead of looking up a client record in its own database.
Why it's emerging now
MCP servers face a registration problem at a scale the original OAuth Dynamic Client Registration (DCR) flow wasn't built for: a single AI client may connect to thousands of MCP servers it has never talked to before, and requiring every server to run a registration database — or requiring a human to manually register each client — doesn't scale. CIMD, standardized as SEP-991, became the default client-registration mechanism in the MCP spec's 2025-11-25 release, and multiple identity vendors have published implementation guides in the months since as MCP servers adopt it.
How it relates to what you know
It's a companion to MCP (already known) — it doesn't change what MCP tools do, it changes how MCP clients authenticate to servers, replacing Dynamic Client Registration as MCP's default client-identity mechanism.