Honor MCP OAuth metadata challenge URLs

[sam-maass]

Summary

• probe the protected MCP resource for an RFC 9728 resource_metadata challenge before derived metadata discovery
• follow and validate the explicitly advertised metadata URL while retaining the existing well-known URL fallbacks
• cover top-level MCP authentication when metadata is available only at a path-scoped challenge URL

Reproduction

Add d0 to ~/.fx/mcp.json:

{
  "mcpServers": {
    "d0": {
      "type": "http",
      "url": "https://d0-web.vercel.tools/eve/v1/mcp",
      "enabled": true
    }
  }
}

Then run either the top-level command:

fx mcp auth d0

or, from an interactive fx session:

/mcp auth d0 --open

Before this fix, authentication fails with:

ProtectedResourceMetadataUnavailable

The d0 resource responds with a 401 Unauthorized challenge that advertises its protected-resource metadata URL. This behavior is valid under RFC 9728 Section 5.1, which defines the resource_metadata parameter for providing the protected-resource metadata URL:

WWW-Authenticate: Bearer resource_metadata="https://d0-web.vercel.tools/eve/v1/.well-known/oauth-protected-resource", scope="d0:invoke"

Root cause

• fx mcp auth d0 did not first contact the protected resource.
• Consequently, it never received d0's WWW-Authenticate challenge.
• Without the advertised resource_metadata URL, fx tried only its already-correct RFC-derived fallback URLs.
• Those fallback URLs do not exist on d0, resulting in ProtectedResourceMetadataUnavailable.

d0's challenge-directed metadata discovery is standards-compliant. The bug was not that fx dropped the resource path while constructing the RFC 9728 fallback URL. fx already derived https://d0-web.vercel.tools/.well-known/oauth-protected-resource/eve/v1/mcp correctly, but d0 returns 404 there and instead relies on its challenge-advertised metadata URL.

Verification

• zig fmt --check src/
• zig build
• bun test mcp-auth.test.ts --test-name-pattern 'top-level MCP auth' — 2 passed, 0 failed
• bun test mcp-auth.test.ts — 31 passed, 14 environment skips, 0 failed
• real d0 flow with isolated HOME using ./zig-out/bin/fx mcp auth d0 — exit 0, authenticated, stderr empty

Full CI is pending on this draft PR. The required type: bug label must be applied by a maintainer because the PR author cannot manage labels in the upstream repository.