Why your MCP server should serve OAuth Protected Resource Metadata — AuthKit + RFC 9728

The problem: too many clients, too few discovery hooks We expose Supabase Edge Functions as MCP (Model Context Protocol) servers. The clients that hit them are heterogeneous — Claude Desktop, Codex CLI, Cursor, VS Code Continue, a couple of in-house browser extensions. None of them ship with a hard-coded "use WorkOS AuthKit, scope is tool:ai_chat , audience must contain urn:jibun:tool: " recipe. Without a discovery mechanism, every new client needs a hand-written runbook, and every change to the