OAuth: metadata advertises RFC 9207 `iss` support, but /authorize never sends `iss` → strict MCP clients (Claude Code) reject login

Summary

https://mcp.tripletex.no/.well-known/oauth-authorization-server advertises

"authorization_response_iss_parameter_supported": true

but the redirect back from https://mcp.tripletex.no/authorize does not include the iss parameter (only code and state).

Per RFC 9207 §2.4, a client that sees this flag MUST validate iss in the authorization response. MCP clients built on the current MCP TypeScript SDK (spec 2026-07-28 / SEP-2468) therefore reject the login:

Issuer mismatch in authorization response (RFC 9207): expected "https://mcp.tripletex.no/", received undefined

Reproduce

1. Add https://mcp.tripletex.no as an HTTP MCP server in Claude Code (v2.1.234).
2. Run /mcp → tripletex → Authenticate, complete login in the browser.
3. Browser shows "Authentication successful", but Claude Code shows the error above and the server stays in "needs authentication".

Same server works via the claude.ai / Claude Desktop connector, because that OAuth client does not enforce the iss check yet.

Environment

• Claude Code 2.1.234 (macOS)
• Metadata checked 2026-08-18

Start at the /authorize entry point and the /.well-known/oauth-authorization-server metadata endpoint; compare their response behavior with RFC 9207 §2.4. Reproduce the flow in Claude Code and verify that the advertised capability and authorization redirect agree without an issuer-mismatch error.