MCP Server Configuration - No Option to disable Dynamic Client Registration and use custom(static) client information for Authorization

[ranpariyachetan]

Does this issue occur when all extensions are disabled?: Yes/No

• VS Code Version: 1.102.0 (Universal)
• OS Version: macOS Sequoia 15.5

MCP Server Configuration should allow disabling the Dynamic Client Registration and using a static client information.

Current observation:

When VS-Code receives 401 error from MCP Server, it attempts to perform DCR.

In cases where Server does not expose client registration endpoint, MCP server configuration fails with following error
Error: Dynamic registration failed: Registration to <<register_endpoint>> failed.

Using static client information using environment variable or JSON configuration is not supported.

Following is what should be supported:

1. A reliable way to force-disable DCR in MCP Server configuration so that it skips the attempt to DCR even when server advertised the client_registration in its metadata.
2. The ability to use static client information from environment variable or server configuration. VS-Code should use the static client information to initiate Authorization flow with the Authorization Server.

It is not know and documented, that if MCP Server can be configured using Static Client Information. If this is supported in VS code, please guid me to the relevant documentation.
I am also interested to know if there is any work around I can use to configure static client information so that it is used without triggering DCR.

1. If using static client information for MCP Server is already supported in VS-Code, please guide me to the relevant documentation.
2. Any work around of recommendation to achieve using static client information without using DCR?
3. Is there any change I can do in VS-Code source files on my local machines temporarily?

Steps to reproduce.

Add MCP Client with http transport.

{
	"servers": {
		"mcp-server-f5942888": {
			"url": "http://example.com/mcp",
			"type": "http"
		}
	}
}

Click start or restart option at the top of the configuration.

Actual:

1. Server status changes to error.
2. Output window logs error indicating the failure Dynamic Registration.

Error: Dynamic registration failed: Registration to <<registration_endpoint>> failed:

Expectations:

1. I should be able to use a flag in the configuration to disable the DCR.
2. I should be able to configure client information in MCP server configuration.
3. If DCR endpoint is not available or DCR fails for any reason, configured client information should be used to perform Authorization.

The MCP server configuration an be improved by introducing a new configuration object for Auth as following.

"mcp-server-f5942888": {
	"url": "http://example.com/mcp",
	"type": "http",
	"auth": {
		"useDyamicRegistration": false,
		"client_id": "<<client_id>>", # preferably retrieved from environment variables using ${env:MCP_CLIENT_ID}
		"client_secret": "<<client_secret>>" # preferably retrieved from environment variables ${env:MCP_CLIENT_SECRET}
	}
}

Current Version of VS Code

Version: 1.102.0 (Universal)
Commit: cb0c47c
Date: 2025-07-09T22:10:34.600Z
Electron: 35.6.0
ElectronBuildId: 11847422
Chromium: 134.0.6998.205
Node.js: 22.15.1
V8: 13.4.114.21-electron.0
OS: Darwin arm64 24.5.0

[vs-code-engineering]

Thanks for creating this issue! It looks like you may be using an old version of VS Code, the latest stable release is 1.102.1. Please try upgrading to the latest version and checking whether this issue remains.

Happy Coding!

[ranpariyachetan]

Updated the VS Code Version to the latest one as per the recommendation above. But that did not improve the situation.

Latest Version of VS Code used

Version: 1.102.1 (Universal)
Commit: 7adae6a
Date: 2025-07-15T16:41:17.147Z
Electron: 35.6.0
ElectronBuildId: 11847422
Chromium: 134.0.6998.205
Node.js: 22.15.1
V8: 13.4.114.21-electron.0
OS: Darwin arm64 24.5.0

[TylerLeonhardt]

Chetan Ranpariya (@ranpariyachetan) I'd rather we focus on why this Authorization Server isn't playing nice with our call for dynamic registration.

Why doesn't it work? What Authorization Server is this?

[ranpariyachetan]

TylerLeonhardt

I understand the preference for Dynamic Client Registration (DCR), but my request is for support for static client credentials (Client ID and Secret) as an alternative.

I’m currently using an Auth service that doesn’t support Dynamic Client Registration (DCR), and it’s not something I can enable easily or anytime soon. I totally get that DCR is the preferred flow, but since it’s not a hard requirement in the MCP Auth spec (or OAuth2/OIDC), I was hoping the client could support static client creds (Client ID + Secret) as a fallback.

And I am sure many, if not all, enterprise environments don't have support for DCR due to operational and/or security reasons.

Supporting static client information would make the MCP clients more flexible and usable in such cases, without breaking spec or compromising security.

I think it’d really help adoption and make life easier for folks integrating in more locked-down setups.

[TylerLeonhardt]

If your authorization server does not support DCR then please give this a try in Insiders: https://code.visualstudio.com/insiders/

As I'm pretty sure this works as of a few weeks ago.

[ranpariyachetan]

Thanks TylerLeonhardt

I used VS Code Insiders and tried configuring MCP server to use static client information as well as skipping DCR. But I am not sure how the configuration structure looks like and what ar the parameter names.

Tried following ways to configure MCP server.

"mcp-dev-ref-server": {
    "url": "<<mcphost>>/mcp",
    "type": "http",
    "env": {
        "MCP_CLIENT_ID": "<<client_id>>",
        "MCP_CLIENT_SECRET": "<<client_secret>>"
     }
}

"mcp-dev-ref-server": {
    "url": "<<mcphost>>/mcp",
    "type": "http",
    "auth": {
        "dynamicRegistration": false,
        "clientId": "<<client_id>>",
	"clientSecret": "<<client_secret>>"
     }
}

Is there any documentation/guide I can go thru for this configuration?

[TylerLeonhardt]

VS Code Insiders should prompt you for the client id & client secret upon starting the server. Do you not see this?

[ranpariyachetan]

Thank you TylerLeonhardt.

Yes, It prompted for the client id and client secret when I tried to connect to MCP server whose Auth Service is not offering DCR. After entering the correct client information the Auth flow was performed and tools were discovered successfully.

Following are my observations of this feature.

1. I observed that, DCR can not be skipped voluntarily. If the DCR is available from the Auth Service, static client information can not be provided by any way. Is this expected? Any plans of making DCR optional and use static client information?
2. Once clientid and secret provided, they can not be changed. I wished to reproduce prompt to record the screen but I could not enforce the prompt even when I changed MCP server URL, name of the server etc. As long as Auth Server, ( and client id too) known to the VS Code, it reused the information. Eventually I deleted everything in the folder /Users/{{username}}/Library/Application Support/Code - Insiders, quit the VS Code Insider and re-launched it. After reconfiguring MCP server in mcp.json, this time it prompted for the ClientId and Client Secret.

• There should be feature to remove configurations, cache, tokens, client information, temp files etc for all or specific MCP server.
• May be a command like MCP: Clear Cache <<MCP Server name>> would make sense.

Thanks

[TylerLeonhardt]

I observed that, DCR can not be skipped voluntarily. If the DCR is available from the Auth Service, static client information can not be provided by any way. Is this expected? Any plans of making DCR optional and use static client information?

This is expected. DCR is really the supported flow and MCP's spec highly encourages it. In other words, if it's available, then we should use it.

Once clientid and secret provided, they can not be changed. I wished to reproduce prompt to record the screen but I could not enforce the prompt even when I changed MCP server URL, name of the server etc. As long as Auth Server, ( and client id too) known to the VS Code, it reused the information. Eventually I deleted everything in the folder /Users/{{username}}/Library/Application Support/Code - Insiders, quit the VS Code Insider and re-launched it. After reconfiguring MCP server in mcp.json, this time it prompted for the ClientId and Client Secret.

There's a command. Open the Command Palette and search for "Authentication Dynamic" and you should find it.

There should be feature to remove configurations, cache, tokens, client information, temp files etc for all or specific MCP server.

You can uninstall servers individually. Also, you should be able to sign out from the Account menu or if you run the command to list servers you should be able to Sign Out from there.

May be a command like MCP: Clear Cache <> would make sense.

In theory, uninstall should be enough here... but it may keep auth state around (please open an issue specific to this so that work can be done piecemeal) there may be some other things that continue to stay present, I'm curious what you notice (cc Connor Peet (@connor4312))

[cimka]

Hi there, I post this comment/questions here because its the most related to what I see (with my knowledge at this moment) for what I would need also.
Context: MCP Client (VSCode) to MCP Server (custom) with Entra ID as Auth server.

With my understanding of DCR, you will for an organization automatically create/use a registered Enterprise Application (in Entra ID) for the given tenant and always use this as the client authentication wise and get consent organization wise for the scope to consume (as seen from the two pictures at the end of this blog post https://blog.mitchbarry.com/net-mcp-server-oauth-with-microsoft-entra-id/).

The issue here from an enterprise point of view, is that you potentially have 100 or even more custom MCP servers with there specific authentication requirements (unique Entra ID Applications) all wanting to use VSCode as the MCP Client, mixing in local testing with authentication and production MCP Servers. It is in my opinion not a good idea to force everyone to consent there applications/scopes to the one VSCode Enterprise Application registered in the tenant for the organization.
So I am saying all of this because I would also want the ability to manually disable DCR (Dynamic Client Registration) so VSCode's great MCP Client could be used in a bigger picture. I struggle to see with my knowledge (maybe I am missing something here hehe :) ) how VSCode and its MCP Client would be as useful as it could be without this feature. I posted it here because related and it's also open. Even if my view/points are different.

[TylerLeonhardt]

We don't use DCR for EntraID. Instead, the client id that we use for any MCP server that uses Entra as an authorization server is VS Code's client id: aebc6443-996d-45c2-90f0-388ff96faa56

vscode/extensions/microsoft-authentication/src/common/scopeData.ts

Line 8 in 7b4f081

const DEFAULT_CLIENT_ID = 'aebc6443-996d-45c2-90f0-388ff96faa56';