Fix OAuth: use authorization_servers URL from resource metadata for scope discovery

[Copilot]

Summary

discoverScopes always used the MCP server URL for authorization server metadata discovery, ignoring authorization_servers from the protected resource metadata. This breaks OAuth when the auth server is on a different domain than the MCP server (Keycloak, Entra ID, etc.).

Fixes #675

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Documentation update
• Refactoring (no functional changes)
• Test updates
• Build/CI improvements

Changes Made

The oauth-state-machine.ts metadata_discovery step already correctly extracts authorization_servers[0] from resource metadata. But discoverScopes in auth.ts—called from both the debug and normal OAuth flows—hardcoded new URL("/", serverUrl) as the discovery target.

// Before: always discovers from MCP server domain
const metadata = await discoverAuthorizationServerMetadata(
  new URL("/", serverUrl),
);

// After: uses authorization_servers from resource metadata when available
const authServerUrl =
  resourceMetadata?.authorization_servers?.length
    ? new URL(resourceMetadata.authorization_servers[0])
    : new URL("/", serverUrl);
const metadata = await discoverAuthorizationServerMetadata(authServerUrl);

Related Issues

Addresses the issue where Inspector ignores authorization_servers from protected resource metadata during scope discovery, per MCP spec Section 4.3.

Testing

• Tested in UI mode
• Tested in CLI mode
• Tested with STDIO transport
• Tested with SSE transport
• Tested with Streamable HTTP transport
• Added/updated automated tests
• Manual testing performed

Test Results and/or Instructions

Added 3 test cases to auth.test.ts:

• Uses authorization_servers URL from resource metadata for discovery (different domain)
• Preserves full path in authorization_servers URL (e.g. /realms/my-realm/)
• Falls back to serverUrl when authorization_servers is empty

All 490 tests pass.

Checklist

• Code follows the style guidelines (ran npm run prettier-fix)
• Self-review completed
• Code is commented where necessary
• Documentation updated (README, comments, etc.)

Breaking Changes

None.

Additional Context

None.

[cliffhall]

@BobDickinson @olaservo Note, this is what we're doing in oauth-state-machine.ts. It is just wrong that we're doing this in two places, V2 should be more unified on this front.