scopes_supported mismatch between MCP protected-resource metadata and OAuth server metadata breaks OAuth-based MCP clients with invalid_scope