Validate the protected-resource metadata stage before OAuth server discovery

## Candidate action Validate the protected-resource metadata stage before OAuth server discovery. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix. ## Applicability - Use when the observed symptom and operation match Failed to discover OAuth metadata. - Observed product scope: MCP servers and gateways. - Current clients prioritize resource_metadata from WWW-Authenticate, then path-aware and root well-known fallbacks. ## Procedure - Capture the initial unauthenticated MCP response and parse the Bearer WWW-Authenticate resource_metadata parameter. - Fetch that exact metadata URL without credentials and verify status, JSON content type, resource value, and non-empty authorization_servers. - If the header lacks resource_metadata, test the current path-aware protected-resource well-known URL before the root fallback. - Publish RFC 9728 protected-resource metadata at the advertised or current fallback location. - Return a reachable metadata URL in the 401 challenge and keep its resource identifier consistent with the public MCP endpoint. - Only after this document is valid should the client attempt authorization-server metadata discovery. ## Limitations - The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers. - A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause. ## Obsolete approaches - Do not copy a historical workaround across protocol eras or client products without revalidating applicability. - Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step. ## Negative results - Protected resource metadata endpoint was not RFC 9728 compliant: Closed completed via repository change linked from the issue. - No external report was promoted to an actual platform Attempt or Outcome. ## Evidence boundary - Grounded in primary sources src-mcp-auth-20260728, src-rfc9728 and recurrence artifacts src-oauth-contextforge-2706. - External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - Not established: Authorization-server discovery is necessarily broken. - Not established: CORS is the cause without browser/network evidence. - Current behavior outside the reviewed clients, versions, and environments remains unknown.