Connect Claude Code and VS Code without client registration, and serve an MCP server straight from your domain root

MCP clients that identify themselves with a URL, including Claude Code and VS Code, can now finish the OAuth flow without Dynamic Client Registration, loopback redirects included. Custom domains gained a root route: point https://your-domain.com/ at one of your MCP endpoints and clients connect at the bare domain while browsers get the installation page.

Features

• OAuth without Dynamic Client Registration #4730 - The session OAuth authorization server now supports Client ID Metadata Documents, so clients that present a URL-shaped client ID, such as Claude Code and VS Code, complete the flow without registering first, including loopback redirects on any port. Available per organization behind the gram-user-session-cimd flag. (Author: @bflad)
• Route a custom domain root to a default MCP server #4601 - Pick one of the domain's MCP endpoints as its default and the bare domain serves that server directly, with slug renames following automatically. Custom domains can also serve an OpenAI app-submission verification token at /.well-known/openai-apps-challenge, so a ChatGPT app review can verify domain ownership with no changes to your own site. Both settings live on the custom domain page, and the default server can also be set from an MCP server's settings. (Author: @ThomasRooney)

Bug fixes

• Renamed shadow MCP servers keep the new name #4697 - Renames written in quick succession could tie on their stored version and intermittently revert to an older observed name. Versions are now stored at nanosecond precision so each update supersedes the state it was based on. (Author: @ThomasRooney)
• Detector copy no longer lists specific coding agents #4769 - Shadow MCP detector text and other product strings use generic wording, so a newly supported agent doesn't need a copy change to be covered. (Author: @svadrutk)