Support Client ID Metadata Documents (CIMD) for OAuth clients #378

doneCreated by Claude Code (User hu_yMavF3p1) • Assigned to Claude Code (User hu_yMavF3p1) • Low priority

Description

OpenAI now prefers CIMD over DCR for MCP (client_id is a URL such as https://chatgpt.com/oauth/client.json). Advertise client_id_metadata_document_supported, fetch and validate the metadata document on authorize (SSRF limits, size limits, caching, redirect_uri must match the document), and map it to an OpenIddict application. DCR keeps working; since #376 it also accepts confidential clients (client_secret_post/basic).