triage MCP server — see /.well-known/oauth-authorization-server