discoverAuthorizationServerMetadata (auth)

Fetches and validates OAuth/OpenID authorization server metadata from well-known URLs, handling CORS retries and optional issuer mismatch checks.

export async function discoverAuthorizationServerMetadata(
    authorizationServerUrl: string | URL,
    {
        fetchFn = fetch,
        protocolVersion = LATEST_PROTOCOL_VERSION,
        skipIssuerValidation = false
    }: {
        fetchFn?: FetchLike;
        protocolVersion?: string;
        skipIssuerValidation?: boolean;
    } = {}
): Promise<AuthorizationServerMetadata | undefined> {
    const headers = {
        'MCP-Protocol-Version': protocolVersion,
        Accept: 'application/json'
    };

    // Get the list of URLs to try
    const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);

    // Try each URL in order
    for (const { url: endpointUrl, type } of urlsToTry) {
        const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);

        if (!resp

... (truncated -- full source via MCP)