Tags: 7anX/AgentScan

v1.1.0: MCP 2026-07-28 modern stateless transport detection

feat: add OAuth 2.0 discovery for auth-required MCP servers

For MCP servers that return 401/403, probe the two-stage RFC 9728 to
RFC 8414 discovery chain (all public/unauthenticated endpoints) to
extract authorization server metadata: token endpoint, registration
endpoint, scopes, grant types, and the exact well-known URL probed.

- models: add OAuthMeta struct with DiscoveryURL field
- scanner: mcp_oauth.go three-priority discovery (WWW-Authenticate
  resource_metadata URL, RFC path-insertion URL, host-level URL)
- scanner: mcp_probe.go treat RFC 9728 WWW-Authenticate signal as
  strong auth-required evidence (+3 score, hasMCPHeader=true)
- scanner: pipeline.go call probeOAuthMeta for every auth-required hit
- output: terminal, html, unified_html render OAuth Discovery section
  with Chinese labels and discovery URL

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>