A remote Model Context Protocol server behind a real OAuth 2.1
boundary, with clients identified by Client ID Metadata Documents
instead of pre-registration. Every button below performs the real flow against
this server and shows you the actual HTTP exchange.
This is a demonstration deployment. The authorization server is a
mock with in-memory state and ephemeral signing keys, and client identities are
published by this server rather than by you — a real client would host its own
metadata document. CIMD resolution is restricted to an allowlist here, because a
public server that dereferences any URL it is handed is an unauthenticated request
amplifier. Do not point production clients at it.