MCP OAuth: AS discovery uses bare /.well-known/oauth-authorization-server instead of RFC 8414 path-based URL

Summary

When Claude Code discovers the Authorization Server metadata for an MCP connector, it constructs the discovery URL by doing:

new URL('/.well-known/oauth-authorization-server', issuerUrl)

For an issuer with a path (e.g. https://gateway.example.com/github), this strips the path and fetches:

https://gateway.example.com/.well-known/oauth-authorization-server

Per RFC 8414 Section 3, the correct URL for a path-based issuer is:

https://gateway.example.com/.well-known/oauth-authorization-server/github

Impact

Any MCP gateway that serves per-server AS metadata at the RFC 8414 canonical path will have working metadata at /.well-known/oauth-authorization-server/github (with registration_endpoint) but the SDK fetches the bare URL which returns generic metadata without registration_endpoint. Claude Code then errors:

Incompatible auth server: does not support dynamic client registration

Reproduction

1. Protected resource at /.well-known/oauth-protected-resource/github/mcp returns authorization_servers: ["https://gateway/github"]
2. Claude Code fetches https://gateway/.well-known/oauth-authorization-server (no registration_endpoint)
3. Error fires

The correct URL https://gateway/.well-known/oauth-authorization-server/github is never fetched even though it returns valid metadata with registration_endpoint.

Expected behavior

For issuer https://gateway/github (has path /github), the AS discovery URL should be:
https://gateway/.well-known/oauth-authorization-server/github

This is RFC 8414 Section 3 compliant: {issuer_host}/.well-known/oauth-authorization-server{issuer_path}

Verified in

Claude Code 2.1.275 — binary only contains the bare path string /.well-known/oauth-authorization-server, no path-appended variant.