X_MCP_OAUTH_INVALID
Means
the MCP oauth block cannot be published as protected-resource metadata
Typical cause
no authorizationServers, an issuer that is not an absolute https URL (http only for localhost), or a resource / resourceDocumentation that is relative or carries a fragment. Refused at boot, before a client reads the metadata
Fix
defineAppMcp({ ..., oauth: { authorizationServers: ['https://www.example.com'] } }) — at least one absolute https (or http://localhost) issuer URL, and resource, when set, an absolute URL with no fragment