OAuth 2.0 Dynamic Client Registration (RFC 7591)

Registers a public OAuth client for the MCP flow. No client secret is issued (PKCE-protected public clients only). redirect_uris must be HTTPS, or an RFC 8252 loopback (http://127.0.0.1[:port]/..., http://[::1][:port]/..., or http://localhost[:port]/...), and are exact-matched at /authorize. Registration needs no manual step (RFC 7591), but an HTTPS redirect_uri is admitted only when its hostname exactly matches Mnemom's reviewed MCP-host allowlist (for example chatgpt.com, claude.ai and vscode.dev), on the default port, with no wildcard or prefix matching; any other host is rejected with invalid_redirect_uri here, and /authorize refuses it again (an error page, never a redirect). Loopback redirect_uris are accepted on any port. A device-only client (no redirect_uris) completes the flow but is issued a token with no capability unless its client_id is explicitly vetted by an operator, and its consent screen says so. Contact Mnemom to have an additional client host reviewed and added. Registration is abuse-guarded with per-IP and global daily caps.