fix(mcp-worker): restore dynamic client registration endpoint

[jonathannorris]

Summary

• Re-adds clientRegistrationEndpoint: '/oauth/register' to the remote MCP worker's OAuthProvider config.
• Reverts the one-line removal from Remove unused registration endpoint. #577, which broke OAuth for MCP clients that rely on Dynamic Client Registration (Claude Code, mcp-remote).

The Problem

#577 removed the registration endpoint on the assumption it was unused ("we don't actually support or use anything to do with client registration"). It was not unused: @cloudflare/workers-oauth-provider implements RFC 7591 Dynamic Client Registration automatically whenever clientRegistrationEndpoint is set, and for our server that is the only registration mechanism a client can use (see below).

Removing the option has two effects in the library:

1. /.well-known/oauth-authorization-server no longer advertises a registration_endpoint. The field is only emitted if (options.clientRegistrationEndpoint), so it disappears entirely from discovery.
2. /oauth/register is no longer routed and falls through to the default handler, returning 404 Not Found.

The MCP authorization spec gives clients three ways to register: pre-registered static credentials, Client ID Metadata Documents (CIMD), and Dynamic Client Registration. A client tries them in that order and only falls back to DCR when the first two aren't available. Our server offers neither of the first two, so DCR is the only path left, and #577 turned it off.

When that fallback is reached and the discovery metadata has no registration_endpoint, the MCP TypeScript SDK throws (in registerClient(), packages/client/src/client/auth.ts):

Incompatible auth server: does not support dynamic client registration

Claude Code surfaces this with a SDK auth failed: prefix. This is the exact error users hit on claude mcp add --transport http devcycle https://mcp.devcycle.com/mcp (and via npx mcp-remote) since #577 landed. The Claude Code MCP docs call out this error by name under "Authenticate with remote MCP servers".

Verified against the live server

$ curl -s https://mcp.devcycle.com/.well-known/oauth-authorization-server
{"issuer":"https://mcp.devcycle.com","authorization_endpoint":".../oauth/authorize",
 "token_endpoint":".../oauth/token", ... "client_id_metadata_document_supported":false}
# no registration_endpoint

$ curl -s -o /dev/null -w '%{http_code}' -X POST https://mcp.devcycle.com/oauth/register
404

registration_endpoint is absent and client_id_metadata_document_supported is false, so a dynamic MCP client has no way to obtain a client_id.

Follow-up

Restoring DCR is the fastest fix and matches how this worked before #577. The MCP spec now lists DCR as MAY (backwards compatibility) and recommends CIMD for new servers (see the MCP blog post Evolving OAuth Client Registration). If the original removal was security-motivated, supporting CIMD (client_id_metadata_document_supported) is the sanctioned alternative and worth a separate look.

Related

• Reverts Remove unused registration endpoint. #577

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	6ddd1b3	Jul 27 2026, 05:02 PM

[Copilot]

Pull request overview

Restores OAuth Dynamic Client Registration support in the remote MCP worker by reintroducing the clientRegistrationEndpoint option on the Cloudflare Workers OAuth provider, so MCP clients that rely on RFC 7591 can obtain a client_id again.

Changes:

• Re-adds clientRegistrationEndpoint: '/oauth/register' to the OAuthProvider configuration.
• Adds an in-code comment explaining why the registration endpoint is required (notably for Claude Code / mcp-remote).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.