Clients rufen POST /mcp mit Accept: application/json, text/event-stream auf. OAuth/Discovery: /.well-known/…, Autorisierung: /oauth/authorize.
POST /mcp
Accept: application/json, text/event-stream
/.well-known/…
/oauth/authorize