Sign in at an MCP server (discovered authorization server)

The brain as an OAuth client of any MCP server (W4.3): the server’s authorization server is discovered from its 401 (RFC 9728 protected-resource metadata → RFC 8414 / OpenID metadata), a client is registered there dynamically (RFC 7591) unless one the operator registered is passed, and the admin is sent to consent with PKCE and the RFC 8707 resource. The callback keeps a mcp grant for that resource; a pack’s auth: oauth MCP source then runs as it. 404 until SOURCE_MCP_OAUTH=1. Connected accounts (docs/source-plane.md § Connected accounts): the brain as an outbound OAuth 2.1 client for the cloud connectors (gdrive, onedrive, dropbox). Answers a bare 404 until SOURCE_PLANE_ENABLED=1 and SOURCE_OAUTH_CLIENT=1; needs SOURCE_CREDENTIAL_ENCRYPTION_KEY — tokens are never stored in the clear.

Required scope: brain:admin.