GHSA-33F5-2C5Q-WGWJ RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

Summary The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata RFC 9728, allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens. Details RFC 9728 specifies two MUST requirements for...