Back to Gitlabhq

Disable OAuth Dynamic Client Registration for MCP

doc/releases/19/gitlab-19-3-released/disable-oauth-dynamic-client-registration.md

19.3.0572 B
Original Source

Previously, MCP clients and AI tools could automatically register OAuth applications on your instance through Dynamic Client Registration (DCR), which you couldn't turn off. This made it difficult for administrators on GitLab Self-Managed and GitLab Dedicated instances to control which OAuth clients could connect.

Now you can disable DCR entirely using the application settings API, giving you full control over which OAuth clients can access your instance. When DCR is disabled, clients must use a pre-registered OAuth application instead of registering automatically.