Auth: Support manually setting a client ID and client secret

[jpmcb]

Is your feature request related to a problem? Please describe.

Not all OAuth providers support dynamic client registration.

And the MCP specification accounts for this:

Any authorization servers that do not support Dynamic Client Registration need to provide alternative ways to obtain a client ID (and, if applicable, client credentials). For one of these authorization servers, MCP clients will have to either:

1. Hardcode a client ID (and, if applicable, client credentials) specifically for the MCP client to use when interacting with that authorization server, or
2. Present a UI to users that allows them to enter these details, after registering an OAuth client themselves (e.g., through a configuration interface hosted by the server).

https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#dynamic-client-registration

Describe the solution you'd like

In the guided oauth flow, there should be an option to enter a client ID and a client secret instead of always assuming dynamic client registration.

Related

• Add support for initial access tokens in OAuth 2.0 Dynamic Client Registration #575 - +1 to also supporting initial access tokens for DCR, but the inspector should also support existing clients by entering a client ID / secret

[franz-zuplo]

Highly agree with this, having mandatory DCR in the inspector makes the overhead of testing OAuth authentication flows much higher for certain Auth providers. For example, I'm pretty sure AWS Cognito doesn't support DCR out of the box.

[2underscores]

Agreed, this one's a break from MCP spec. Done with #684

It only supports client ID and no client secret, as AFAIK MCP inspector is all built to act as a public client. This was just an issue with the guided OAuth flow not using it. To add client secret and support token exchange for a confidential client is a bigger PR i think, but not too sure.

[olaservo]

Cross-posting this from my PR comment for more viz:

I think the change makes sense. Since its small but potentially significant I created a thread in the auth channel on the MCP Contributor Discord to get more 👀 on it. If you're interested in following there, you can find the link in these docs: https://modelcontextprotocol.io/community/communication