rfc9728
Fail your CI when an MCP endpoint serves its tool list without a token. Runtime probe and GitHub Action that also checks RFC 9728 OAuth posture and emits an HMAC-signed receipt of what was observed. Single file, stdlib only.
