A production OAuth 2.1 client for MCP: drives protected-resource and authorization-server metadata discovery (RFC 9728 / RFC 8414), Dynamic Client Registration (RFC 7591), and the token endpoint (authorization-code + PKCE, client-credentials, refresh) with RFC 8707 resource indicators.