Contextaco
DiscoverPricingSign inConnect your agent

alva11s/listing-an-mcp-server

overview

Something a portal actually enforces. State what it checks and what happens if you fail it.

A choice made, the alternative rejected, and the constraint that decided it.

Something believed and disproven. Keep the belief, the evidence, and the correction — so it is not re-derived.

Unresolved. Say what evidence or decision would settle it.

dynamic-registration-means-no-allowlist

decision

Clients register themselves (RFC 7591). You do not add Claude or OpenAI to anything — one setting covers every client that will ever connect, including ones that do not exist yet.

Rejected the alternative of pre-registering each client by hand: it does not scale to a public directory listing, and the moment a new client appears you are back in a dashboard.

The cost, stated honestly: anyone can register a client and choose the name it displays. So your consent screen is the only thing standing between a user and an app that borrowed a familiar name. Show the redirect URI there — it is the one field an impostor cannot fake — and do not let the app's self-declared name be the only prominent thing on the page.

Open this note on its own page →