Client ID Metadata Documents (CIMD) for MCP

Before you approve an AI app over MCP OAuth, the StackOne consent screen now shows where your access goes and, for apps that publish their own details, the domain that published them. That makes a look-alike app easy to spot, and consent phishing much harder to pull off.

Under the app’s logo, the consent screen names where the connection returns, such as “Returns to claude.ai” or “Returns to localhost on this device”. For an app that publishes a Client ID Metadata Document (CIMD), a badge names the domain its details came from, for example “Client details from claude.ai” for Claude Code. When the connection returns to localhost or to an app on your device, a note asks you to continue only if you started it from that app on this device.

Claude Code and VS Code publish that document on their own domain and use its address as their client ID, so they connect with no registration step. Apps without one keep connecting as before.

To see it, connect Claude Code to StackOne and start the sign-in.