What
When an MCP server's OAuth flow fails because the server echoed back the wrong issuer, the failure is now reported with a specific reason rather than a generic one, making misconfigured servers easier to identify.
Details
- Three new failure reasons:
issuer_echo_denied,issuer_echo_mismatchandissuer_response_mismatch, each raised from its own error class and checked ahead of the existing reasons. - One authorization-server metadata discovery path now skips the library's built-in issuer check and validates the issuer itself afterwards, throwing the existing "AS metadata discovery failed: issuer mismatch" error.
- MCP connect telemetry gains a sibling-probe field, computed only in
autonegotiation mode, on both the success event andtengu_mcp_server_connection_failed.
Evidence
issuer_echo_denied
Strings lifted out of the shipped bundle, so the claim above can be checked against them.