feat: Add server auth conformance tests#105

Draft

pcarleton wants to merge 12 commits intomainfrom

server-auth-conformance

Commits on Jan 14, 2026

wip server auth conformance first cut
pcarleton
committed
fix: auth-test-server outputs full /mcp endpoint URL
pcarleton
committed
refactor: use SDK requireBearerAuth with token introspection
pcarleton
committed
feat: default to CIMD for fake AS, support both CIMD and DCR in tests
pcarleton
committed
chore: remove auth-test-server (moved to typescript-sdk)
pcarleton
committed
fix: update spec references to 2025-11-25 and simplify fake-auth-server
pcarleton
committed
refactor: use --url and --command for auth tests instead of separate flags
pcarleton
committed
feat: add --interactive flag for browser-based OAuth flows
pcarleton
committed
refactor: simplify callback URL handling
pcarleton
committed
fix: add FAILURE checks for missing phases and expand AS metadata validation
pcarleton
committed
fix: use Omit for clientMetadata type since redirect_uris is added in getter
pcarleton
committed
fix: use text/plain for callback responses to prevent XSS
pcarleton
committed