Tin Chi Lo 447d50fa40 fix(mcp): enforce the OAuth endpoint trust rule at carry-forward too, elide default port ... The corroboration check belongs to adopting a token_url from any non-manual source, not to discovery alone. Carry-forward is the other such source: it copied a prior registry entry's token_url/registration_url onto a rebuild whose authorization_url had been re-pointed to a different server, reviving an uncorroborated token endpoint the discovery gate would reject. Both sites now share one predicate, _endpoints_corroborate_authorization_url: previous endpoints carry forward only when the previous authorization_url corroborates the authorize endpoint the build will use (absent -> the previous one is adopted too, a consistent group; else it must match). Endpoint comparison now elides the default port so :443 and formatting-only differences still match.		2026-07-15 10:39:04 -07:00
..
mcp_server	fix(mcp): enforce the OAuth endpoint trust rule at carry-forward too, elide default port	2026-07-15 10:39:04 -07:00