MCP OAuth: issuer mismatch on a trailing slash rejects a valid authorization server (regression since 2.0.3)

Description

Remote MCP servers whose authorization server has an issuer identifier ending in / fail to connect on 2.0.4+:

Issuer mismatch in authorization server metadata (RFC 8414 §3.3): expected "https://oauth.id.jumpcloud.com", received "https://oauth.id.jumpcloud.com/"

The protected resource metadata (RFC 9728) advertises the authorization server without a trailing slash. The authorization server's own metadata returns its issuer with one. Both forms resolve to the same metadata URL, because RFC 8414 §3.1 requires any terminating / to be removed before inserting the well-known path. So the two strings name the same issuer but fail the §3.3 equality check.

This is a regression. I have logs of the same config connecting on 2.0.1 (2026-09-18) and failing on 2.0.10 (2026-09-19); I have not bisected the releases in between. #48937 (MCP client rework for SDK v2) merged 2026-09-14, between 2.0.3 and 2.0.4, and looks like where the comparison was introduced.

oauth.auth_server_metadata_url from #49126 is not a workaround — it changes where the metadata is fetched from, not the comparison done afterwards. I tested it on 2.0.10 and the error is unchanged.

JumpCloud is publicly reproducible: both https://oauth.id.jumpcloud.com/.well-known/oauth-authorization-server and https://oauth.id.jumpcloud.com/.well-known/openid-configuration return "issuer": "https://oauth.id.jumpcloud.com/". An AWS Bedrock AgentCore gateway configured with a JumpCloud discovery URL publishes "authorization_servers": ["https://oauth.id.jumpcloud.com"], which is the pairing that triggers this.

Would it be reasonable to normalize a trailing slash when comparing issuer identifiers on the metadata path?

OpenCode version

2.0.10 (working on 2.0.1)

Steps to reproduce

1. Configure a remote MCP server whose protected resource metadata lists "authorization_servers": ["https://oauth.id.jumpcloud.com"], with OAuth against that JumpCloud tenant.
2. Run opencode mcp list.
3. The server fails with the error above. opencode upgrade 2.0.1 and the same config connects.

Operating System

macOS 26.6.1 (arm64)

Terminal

ghostty

Start at the MCP OAuth metadata comparison involved in the client rework from #48937, reproducing the failure with opencode mcp list and the JumpCloud issuer pair described here. Trace where the protected-resource authorization server and authorization-server issuer are compared. Done means equivalent issuer URLs differing only by a trailing slash are accepted without weakening the metadata validation.