Vercel MCP now supports Client ID Metadata Documents

Previously, Vercel manually reviewed and allowlisted each MCP client and its redirect URIs before allowing connections, rejecting any unlisted clients. This process required individual approval and slowed adoption for new or unrecognized clients. The new system shifts responsibility to clients by requiring them to publish a Client ID Metadata Document (CIMD), a JSON file hosted on their domain that describes their identity and capabilities. Clients use the HTTPS URL of this file as their OAuth client_id, aligning with the MCP authorization specification’s recommendation for CIMD over Dynamic Client Registration.

To connect, clients must host a CIMD on their domain and reference its URL during the OAuth flow, eliminating the need for Vercel’s manual review. The consent screen now displays the client’s name, logo, and the hostname serving the metadata document, such as "Claude Code by claude.ai", providing transparency about the client’s origin. This change ensures users can verify the source of the client before approving the connection, though unverified clients will not receive a Vercel verified badge.

Existing clients already registered with Vercel remain unaffected and continue to operate under the previous allowlisting process. Their configurations and permissions stay intact, requiring no migration or re-registration. The transition only impacts new or previously unrecognized clients seeking to connect to Vercel MCP.

The update follows the MCP authorization specification’s shift toward CIMD, which standardizes client identification and reduces manual oversight. Developers can now deploy clients more efficiently while maintaining user control over connection approvals. Documentation on Vercel MCP has been updated to guide developers through the new process for publishing and using CIMDs.