Custom connector OAuth flow doesn't respect server-advertised authorize/token endpoints — falls back to guessed generic paths

### MCP server URL or name

Home Assistant MCP Server

### How are you connecting to this server?

From a custom connector URL I entered manually

### Where does the issue occur?

When pressing the Connect button

### When did you last reproduce this?

2026-08-13 11:41:00 BST

### Browser and OS

From claude.ai in Chrome

### Describe the issue

When adding a Custom Connector pointing at a remote MCP server that implements OAuth with non-default endpoint paths (e.g. Home Assistant's MCP integration, which uses IndieAuth-style discovery with endpoints at /auth/authorize and /auth/token rather than the generic /authorize and /token), the connector's OAuth flow does not correctly discover or use those paths. Instead it appears to fall back to guessed default paths (/authorize, /token) relative to the server root, resulting in 404s during both the authorization redirect and the token exchange step.

Steps to reproduce:

Add a Custom Connector with server URL https:///api/mcp/assist (or /api/mcp), pointing at a Home Assistant instance running the built-in Model Context Protocol Server integration.
Leave OAuth Client ID/Secret at defaults, or set Client ID to the connector's own origin (e.g. https://claude.ai) per HA's documented IndieAuth requirement.
Click Connect.

### Error details

```shell
First attempt: registration fails with "Couldn't register with 's sign-in service" (reference ofid_...) — likely because the server doesn't support Dynamic Client Registration (by design, per MCP spec DCR is optional and HA intentionally uses IndieAuth instead).
After manually supplying a Client ID: the authorize redirect goes to https:///authorize?... instead of the server's actual authorization endpoint (https:///auth/authorize), producing a 404.
After working around this at the DNS/proxy layer with a redirect from /authorize → /auth/authorize: the subsequent token exchange also targets https:///token instead of https:///auth/token, again 404ing, requiring a second manual redirect.
That second redirect, if implemented as a 301 (the default in common tools like Cloudflare Bulk Redirects), silently converts the POST token-exchange request to GET, causing a further "Authorization failed" error until the redirect status is changed to 308.
```

### Expected behavior

The connector should perform OAuth metadata discovery per the MCP Authorization spec (e.g. respecting /.well-known/oauth-authorization-server or /.well-known/oauth-protected-resource if present, or otherwise correctly reading whatever discovery mechanism the target server advertises) rather than assuming /authorize and /token are always at the server root. This affects any spec-compliant MCP server that places its OAuth endpoints at non-default paths.

### Additional context

Environment: claude.ai web, Custom Connector (personal account, not Team/Enterprise). Target server: Home Assistant 2026.8.1, Model Context Protocol Server integration ("Silver quality").