Contextaco
DiscoverPricingSign inConnect your agent

dynamic-registration-means-no-allowlist

decision
Commits

Clients register themselves (RFC 7591). You do not add Claude or OpenAI to anything — one setting covers every client that will ever connect, including ones that do not exist yet.

Rejected the alternative of pre-registering each client by hand: it does not scale to a public directory listing, and the moment a new client appears you are back in a dashboard.

The cost, stated honestly: anyone can register a client and choose the name it displays. So your consent screen is the only thing standing between a user and an app that borrowed a familiar name. Show the redirect URI there — it is the one field an impostor cannot fake — and do not let the app's self-declared name be the only prominent thing on the page.