From 31476418348cbe64e935f00677c93be9c143768a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 05:22:21 +0000 Subject: [PATCH 1/2] docs(client): correct the registerClient deprecation citation to spec PR #2858 The @deprecated notice on registerClient attributed the Dynamic Client Registration deprecation to SEP-2577, which is the roots/sampling/logging deprecation; DCR was deprecated via spec PR modelcontextprotocol#2858 in favor of Client ID Metadata Documents (SEP-991). Also name the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarify that the client_id_metadata_document_supported gate lives in the built-in auth() flow, not in registerClient itself. The migration guide's registerClient bullet now carries the same provenance. Fixes #2719 Co-Authored-By: Claude --- .changeset/dcr-deprecation-citation.md | 5 +++++ docs/migration/upgrade-to-v2.md | 6 ++++-- packages/client/src/client/auth.ts | 15 +++++++++++---- 3 files changed, 20 insertions(+), 6 deletions(-) create mode 100644 .changeset/dcr-deprecation-citation.md diff --git a/.changeset/dcr-deprecation-citation.md b/.changeset/dcr-deprecation-citation.md new file mode 100644 index 0000000000..14cb84d7e4 --- /dev/null +++ b/.changeset/dcr-deprecation-citation.md @@ -0,0 +1,5 @@ +--- +'@modelcontextprotocol/client': patch +--- + +Correct the `registerClient` `@deprecated` notice: Dynamic Client Registration was deprecated by spec PR modelcontextprotocol#2858 (Client ID Metadata Documents), not SEP-2577 (which deprecates roots, sampling, and logging). The notice now also names the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarifies that the `client_id_metadata_document_supported` gating lives in the built-in `auth()` flow — `registerClient` called directly always sends the registration request. Documentation only; no runtime behavior change. diff --git a/docs/migration/upgrade-to-v2.md b/docs/migration/upgrade-to-v2.md index 802c2ec264..dc92639579 100644 --- a/docs/migration/upgrade-to-v2.md +++ b/docs/migration/upgrade-to-v2.md @@ -484,8 +484,10 @@ instead. `ToolChoice`, `ToolUseContent`/`ToolResultContent`, the `includeContext` enum values), and the full Roots stack (`Root`, `ListRootsRequest`/`Result`, `RootsListChangedNotification`). -- **`registerClient`** (Dynamic Client Registration) — prefer Client ID Metadata - Documents per SEP-991. +- **`registerClient`** (Dynamic Client Registration) — deprecated via spec PR + [modelcontextprotocol#2858](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2858) + rather than SEP-2577 (listed here because the `@deprecated` annotations landed in + the same sweep); prefer Client ID Metadata Documents per SEP-991. The deprecation is annotation-only — JSDoc `@deprecated` markers were added, nothing else: every deprecated runtime API keeps its v1 call signature (e.g. diff --git a/packages/client/src/client/auth.ts b/packages/client/src/client/auth.ts index 7b25c01fe8..4756e86c2a 100644 --- a/packages/client/src/client/auth.ts +++ b/packages/client/src/client/auth.ts @@ -2359,10 +2359,17 @@ export async function fetchToken( * consistently across both DCR and the subsequent authorization request. * * @deprecated Dynamic Client Registration is deprecated as of protocol version - * 2026-07-28 (SEP-2577) in favor of Client ID Metadata Documents (SEP-991). - * Remains functional during the deprecation window (at least twelve months). - * Prefer a CIMD URL `client_id` when the authorization server advertises - * `client_id_metadata_document_supported`; the SDK already gates on this for you. + * 2026-07-28 in favor of Client ID Metadata Documents (SEP-991); the deprecation + * landed via spec PR + * {@link https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2858 | modelcontextprotocol#2858} + * (SEP-2577 is the separate roots/sampling/logging deprecation). Remains + * functional during the deprecation window — at least twelve months under the + * feature lifecycle policy (SEP-2596), so 2027-07-28 is the earliest possible + * removal date. Prefer a CIMD URL `client_id` when the authorization server + * advertises `client_id_metadata_document_supported`: the built-in `auth()` flow + * checks that capability and skips registration for you, but `registerClient` + * itself does not gate — calling it directly always sends the registration + * request. */ export async function registerClient( authorizationServerUrl: string | URL, From ac7a7ef5b5e00451f2460c6acd9375004562be03 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 05:28:58 +0000 Subject: [PATCH 2/2] docs(client): name the clientMetadataUrl precondition for the auth() CIMD gate Co-Authored-By: Claude --- packages/client/src/client/auth.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/client/src/client/auth.ts b/packages/client/src/client/auth.ts index 4756e86c2a..8daadba644 100644 --- a/packages/client/src/client/auth.ts +++ b/packages/client/src/client/auth.ts @@ -2367,9 +2367,9 @@ export async function fetchToken( * feature lifecycle policy (SEP-2596), so 2027-07-28 is the earliest possible * removal date. Prefer a CIMD URL `client_id` when the authorization server * advertises `client_id_metadata_document_supported`: the built-in `auth()` flow - * checks that capability and skips registration for you, but `registerClient` - * itself does not gate — calling it directly always sends the registration - * request. + * skips registration for you when that capability is advertised AND your + * provider supplies `clientMetadataUrl`, but `registerClient` itself does not + * gate — calling it directly always sends the registration request. */ export async function registerClient( authorizationServerUrl: string | URL,