docs: add CLI/SDK PKCE flow and dynamic client registration (DCR) guide for MCP servers

[saif-at-scalekit]

Summary

A customer building a companion CLI/SDK for their MCP server (already using Scalekit OAuth) asked about best practices for CLI-specific PKCE flows and dynamic client registration (DCR). Scalekit does not currently document a recommended approach for the MCP client side of this integration (Pylon #658).

Customer question

I was able to integrate your OAuth flow for my MCP server, and now I'm building a companion SDK/CLI that will access the same MCP server endpoints. Do you have any best practices or utils to instrument the SDK/CLI to perform dynamic client registration?

Support response

Pointed to the mcp-jam reference implementation as the closest available resource. Scalekit noted it does not have native utilities for the MCP client side.

Documentation gap

The docs should cover:

1. CLI/native app PKCE flow: How to configure OAuth redirect URIs for CLI tools (typically localhost:{port} or loopback addresses), including Scalekit's wildcard port matching for localhost (see also GH docs: add MCP auth troubleshooting — localhost redirect URI and CIMD/DCR fallback #586)
2. Dynamic client registration (DCR): How an MCP client dynamically registers with Scalekit at runtime
3. CIMD vs DCR: When to use Client Instance Metadata Document vs full DCR, and how to fall back between them
4. Best practices: Handling dynamic ports, token storage for CLI sessions, and refresh token behavior in non-browser contexts

Related issues

• GH docs: add MCP auth troubleshooting — localhost redirect URI and CIMD/DCR fallback #586: MCP auth troubleshooting — localhost redirect URI and CIMD/DCR fallback
• Pylon Add Tableau connector docs #626: localhost redirect URI error with Claude Code

References

• Pylon fix: move connector sections into sync-safe templates (xero, datadog, tableau) #658: https://app.usepylon.com/issues?issueNumber=658
• mcp-jam DCR reference: https://github.com/MCPJam/inspector/blob/7136cce87885b8c1c7404cec89b92da4362e9297/mcpjam-inspector/client/src/lib/oauth/client-registration.ts