Discovery Mechanisms for MCP Clients

Security Requirement

MCP clients MUST support both of the following discovery mechanisms for locating authorization servers:

1. OAuth 2.0 Authorization Server Metadata (RFC 8414)
2. OpenID Connect Discovery 1.0

Supporting both mechanisms ensures interoperability with any authorization server an MCP server may designate.

OAuth 2.0 Authorization Server Metadata (RFC 8414)

The client fetches metadata from /.well-known/oauth-authorization-server: