[mzeng-openai]

Motivation and context

A resource configured at https://[fd00::1]:8443/mcp can advertise https://[fd00::1]:8443 as its OAuth issuer. In rmcp 3.7, discovery skips that issuer when it appears in authorization_servers. If it’s the only entry, login fails before the SDK requests its metadata.

Allow a native IPv6 unique-local issuer (fc00::/7) when its scheme, IP address and effective port match the configured resource. The comparison uses the resource URL even when a different host serves its protected-resource metadata. The SDK’s default HTTP resolver already permits the configured IP literal.

How has this been tested?

• On main, both same-origin regression cases fail. With the patch, all 12 cases pass. The tests check which issuer URL the SDK actually requests, including when the advertised IP, port or scheme differs.
• All 515 rmcp library tests pass with the auth,client features.
• With a loopback-only HTTP fixture, a CLI using the custom OAuth HTTP client completed PKCE login with both dynamic registration and a configured client ID. It also reconnected with a saved token and listed a tool.

Breaking changes

No API or configuration changes.

Type of change

• Bug fix

Checklist

• cargo +nightly fmt --all --check
• cargo clippy -p rmcp --lib --tests --features auth,client,transport-io -- -D warnings

AI assistance

Codex reproduced the issue, wrote the patch and regression tests, ran validation, and drafted this PR description.

[github-actions]

@DaleSeo (assignment failed) is on triage rotation this week and is the reviewer for this one.

Labels come from the PR labeler. Please review the change.

_{Automated triage. Labels are a first pass and the assigned maintainer has the final say.}