A few scattered thoughts:
- The
latest spec of MCP has deprecated DCR in favor of CIMD. It is only included for backward compatibility now.
- I would appreciate concrete examples of how AB-DCR compares to CIMD, and where AB-DCR might be more appropriate to use. Off the top of my head - this would be primarily for clients unable to host a CIMD URL? So primarily native applications or CLI tools that are not associated with a website or domain?
- I would be interested in exploring mechanisms that combine the approval of the client with an authorization grant, so that the user doesn't need to click through multiple flows back-to-back.
Niel wrote:
> clients are not tied to one particular user, so this seems dangerous if any user can approve a client for everyone
I think this is an issue the AS is already equipped to solve. The AS must already have a policy defining which user or developer can register a client manually, and that same policy should extend to which user can approve a client registration. If the AS allows any developer to self-serve sign up and create a client, then that same policy should govern client approval.
