OAuth protected-resource metadata for the default MCP surface

Returns the RFC 9728 path-scoped protected-resource metadata for the /mcp MCP surface, which is what its WWW-Authenticate challenge names on a 401. Identical to the origin-wide document except that resource names /mcp on this origin rather than the origin itself, so a client can check the document answers for the endpoint it called.

curl -X GET "https://charm.ing/.well-known/oauth-protected-resource/mcp"

const response = await fetch("https://charm.ing/.well-known/oauth-protected-resource/mcp", {
  method: "GET"
});

import requests

response = requests.get(
    "https://charm.ing/.well-known/oauth-protected-resource/mcp",
)

{}