fix: validate MCP OAuth token endpoints

[dungdong-aws]

Summary

Validates OAuth token endpoints before refresh-token and authorization-code exchanges for MCP servers.

Remote endpoints must use HTTPS. HTTP remains supported only for loopback endpoints used by local development:

localhost
127.0.0.0/8
[::1]

Behavior

Validation runs immediately before both exchange paths:

refreshGrant()
  → validateTokenEndpoint()
  → POST refresh-token exchange

pkceGrant()
  → validateTokenEndpoint()
  → POST authorization-code exchange

Malformed URLs, unsupported schemes, non-loopback HTTP endpoints, and lookalike
hosts such as localhost.example.com are rejected before fetchCompat() is called.

Screenshots

Screen.Recording.2026-09-17.at.12.10.47.PM.mov

Tests

Adds coverage for:

• accepted HTTPS and loopback HTTP endpoints;
• rejected remote HTTP, lookalike-host, unsupported-scheme, and malformed endpoints;
• the normal silent-refresh flow, asserting a rejected endpoint causes no
  fetchCompat() call.

Manual verification

Verified with a disposable local MCP/OAuth harness:

• a discovered remote HTTP token endpoint produced:

  MCP: OAuth failed: OAuth: token endpoint must use HTTPS unless it is a loopback address
  

  before any exchange request;
• a local HTTPS endpoint with a disposable trusted certificate received a real
  POST /token, proving the HTTPS path remains allowed;
• the mock observed the resulting bearer header on the later MCP connection attempt.

The harness intentionally does not implement the full MCP SSE transport, so its
final non-200 MCP transport response is expected after the endpoint-validation
check completes.

Validation

• Prettier, TypeScript no-emit compile, git diff check, and normal hooks passed.
• Focused unit suite remains pending; CI will run repository checks.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 96.55172% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...age-server/agenticChat/tools/mcp/mcpOauthClient.ts	96.55%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!