Vercel MCP lets any client self-register, skipping its review
Vercel MCP now accepts Client ID Metadata Documents, so any MCP client can connect without Vercel reviewing or allowlisting it first. The consent screen shows the client is unverified.
Vercel’s MCP server now accepts Client ID Metadata Documents, letting any MCP client connect without Vercel reviewing it first, the company said on 2 November.
A Client ID Metadata Document is a JSON file a client publishes on its own domain, and the client’s OAuth client_id is simply that file’s HTTPS URL. Until now, connecting a new client to Vercel MCP meant Vercel manually allowlisting its client ID and redirect URIs. The change follows an update to the MCP authorization spec, which now recommends this approach over Dynamic Client Registration for self-service connections. Clients registered the old way keep working unchanged.
Because Vercel hasn’t vetted these self-registered clients, the OAuth consent screen now shows the client’s name, logo and the hostname serving its metadata document, but no verified badge.
Why it matters: if you’re building an MCP client that talks to Vercel, you can ship it without waiting on Vercel to review and allowlist you first. The tradeoff moves to users, who now need to check an unfamiliar hostname on the consent screen rather than trust a badge.