{
  "schema_version": "1.1",
  "id": "s4:https://vercel.com/changelog/vercel-mcp-now-supports-client-id-metadata-documents",
  "slug": "vercel-mcp-now-supports-client-id-metadata-documents-0r8va49",
  "url": "https://feed7.dev/p/vercel-mcp-now-supports-client-id-metadata-documents-0r8va49",
  "title": "Vercel MCP now supports Client ID Metadata Documents",
  "why_included": "Vercel MCP now accepts clients using domain-hosted Client ID Metadata Documents, removing Vercel's prior allowlist review. Approval still depends on trusting the metadata hostname.",
  "summary": "Any MCP client can request a Vercel connection using a **Client ID Metadata Document (CIMD)**: a JSON file on the client's domain, referenced by its HTTPS URL as the OAuth client_id. Users still log in and approve each connection.",
  "practical_implication": "Builders integrating Vercel MCP can publish CIMD metadata instead of waiting for Vercel to review and allowlist the client and redirect URIs. At approval, check the hostname serving the document; these clients lack Vercel's verified badge.",
  "agent_context": "Any MCP client can request a Vercel connection using a **Client ID Metadata Document (CIMD)**: a JSON file on the client's domain, referenced by its HTTPS URL as the OAuth client_id. Users still log in and approve each connection.\n\nBuilders integrating Vercel MCP can publish CIMD metadata instead of waiting for Vercel to review and allowlist the client and redirect URIs. At approval, check the hostname serving the document; these clients lack Vercel's verified badge.\n\nPreviously registered apps are unchanged. The material says the MCP authorization spec recommends CIMD over Dynamic Client Registration, but does not describe client-side security checks beyond the consent screen.",
  "source": {
    "name": "Vercel",
    "url": "https://vercel.com/changelog/vercel-mcp-now-supports-client-id-metadata-documents",
    "published_at": "2026-11-02T20:09:00.000Z"
  },
  "source_class": "blog_post",
  "content_type": "Engineering Post",
  "layer": "context",
  "domains": [
    "coding",
    "security"
  ],
  "topics": [
    "mcp",
    "tool-use"
  ],
  "verification": {
    "status": "official_source",
    "label": "Official Source",
    "method": "source_feed",
    "verified_at": null
  },
  "uncertainty": [
    "Previously registered apps are unchanged. The material says the MCP authorization spec recommends CIMD over Dynamic Client Registration, but does not describe client-side security checks beyond the consent screen."
  ],
  "connected_context": {
    "meaning": "CIMD lets MCP clients request a Vercel connection without prior app allowlisting, while leaving login and per-connection user approval in place. It lowers client registration friction but makes the metadata document’s hostname a relevant approval signal; the brief does not establish further client-side checks.",
    "corpus_size": 990,
    "generated_at": "2026-11-03T13:56:03.675Z",
    "connections": [
      {
        "title": "A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2609.26761v1",
        "feed7_url": "https://feed7.dev/p/2609-26761v1-0dyfymo",
        "reason": "Both make MCP metadata relevant to security: this change introduces a client metadata document users should inspect, while A2M describes malicious tool metadata influencing agent behavior. The latter does not establish a CIMD-specific attack."
      },
      {
        "title": "Latest MCP spec now supported in mcp-handler",
        "source_name": "Vercel",
        "source_url": "https://vercel.com/changelog/latest-mcp-spec-now-supported-in-mcp-handler",
        "feed7_url": "https://feed7.dev/p/latest-mcp-spec-now-supported-in-mcp-handler-1kkt3s0",
        "reason": "Both concern evolving MCP authorization and protocol integration: CIMD changes how clients identify themselves to Vercel, while the handler update changes server protocol compatibility. They address distinct layers of integration."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-11-02T20:09:00.000Z",
  "modified_at": "2026-11-02T20:09:00.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/vercel-mcp-now-supports-client-id-metadata-documents-0r8va49",
    "json": "https://feed7.dev/p/vercel-mcp-now-supports-client-id-metadata-documents-0r8va49.json",
    "markdown": "https://feed7.dev/p/vercel-mcp-now-supports-client-id-metadata-documents-0r8va49.md"
  }
}