OAuth · Discovery: authorization server
RFC 8414 authorization server metadata for MCP clients. Unauthenticated, no /api prefix — this route lives at the host root.
Every scope listed in scopes_supported is registered with Passport, so a client may request all of them; an unregistered scope would fail the authorization request with invalid_scope.
RFC 8414 also permits inserting the path component (/.well-known/oauth-authorization-server/mcp) — that nested variant serves the identical document.
