| 1 | // Selfhost-only: an MCP integration declares NO oauth scopes — the server does. |
| 2 | // At connect, `oauth.start` DISCOVERS the request scopes from the MCP server's |
| 3 | // RFC 9728 protected-resource metadata and asks for exactly those on the |
| 4 | // authorize URL. Proven end-to-end: a real MCP server (in this process) |
nothing calls this directly
no test coverage detected