MCP OAuth remediation verification

Three-leg MCP OAuth remediation verdicts, proven behaviourally against a canary server.