diff --git a/mcp-worker/src/auth.ts b/mcp-worker/src/auth.ts
index 30b99df7..3d3a5cb8 100644
--- a/mcp-worker/src/auth.ts
+++ b/mcp-worker/src/auth.ts
@@ -105,7 +105,14 @@ export async function authorize(
     const clientLogo = client.logoUri || '' // No default logo
     const requestedScopes = (c.env.AUTH0_SCOPE || '').split(' ')
 
-    // Render the consent screen with CSRF protection
+    // Render the consent screen with CSRF protection.
+    //
+    // The consent page reflects client-supplied metadata (client_name, logo_uri)
+    // from Dynamic Client Registration. It contains no first-party JavaScript, so
+    // we lock it down with a strict CSP: `script-src 'none'` blocks every script
+    // execution path (inline <script>, injected event handlers like onerror/
+    // onload, etc.) independently of HTML escaping, and frame-ancestors/base-uri/
+    // object-src close clickjacking and related vectors.
     return c.html(
         renderConsentScreen({
             clientLogo,
@@ -114,6 +121,11 @@ export async function authorize(
             requestedScopes,
             transactionState,
         }),
+        200,
+        {
+            'Content-Security-Policy':
+                "script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+        },
     )
 }
 
diff --git a/mcp-worker/src/index.ts b/mcp-worker/src/index.ts
index 69c10841..736d5522 100644
--- a/mcp-worker/src/index.ts
+++ b/mcp-worker/src/index.ts
@@ -167,6 +167,11 @@ export default {
             defaultHandler: app,
             authorizeEndpoint: '/oauth/authorize',
             tokenEndpoint: '/oauth/token',
+            // Enables RFC 7591 Dynamic Client Registration. MCP clients such as
+            // Claude Code and `mcp-remote` require a `registration_endpoint` in the
+            // OAuth discovery metadata to obtain a client_id; without it they fail
+            // with "does not support dynamic client registration". See PR #577.
+            clientRegistrationEndpoint: '/oauth/register',
             tokenExchangeCallback: createTokenExchangeCallback(env),
         })