Custom MCP connector to Salesforce Hosted MCP is broken

### What happened?

Custom MCP connector to Salesforce Hosted MCP is broken for our entire organization. This is a client-side bug — server-side configuration is fully verified.

The connector builds the OAuth authorize URL as https://api.salesforce.com/authorize?... which returns HTTP 404. It should use https://login.salesforce.com/services/oauth2/authorize, as declared in the server's Protected Resource Metadata (RFC 9728), which returns 200 with authorization_servers: ["https://login.salesforce.com"].

That host does not publish /.well-known/oauth-authorization-server (404) but does publish /.well-known/openid-configuration (200, with a valid authorization_endpoint and mcp_api in scopes_supported). The client does not fall back to OIDC discovery and instead derives the endpoint from the resource origin.

Verified server-side: pasting the correct authorize URL manually with the same client_id, redirect_uri, scope and PKCE parameters returns the Salesforce login screen. External Client App configuration is correct (Authorization Code flow enabled, mcp_api + refresh_token scopes, callback registered, PKCE, named-user JWT).

Supplying OAuth Client ID and Secret under Advanced settings does not help — identical failure with a fresh code_challenge.

No ofid_ reference available: the flow never returns to claude.ai. The browser lands on a 404 at the malformed authorize URL, so no error is registered on Anthropic's side.

Server URL: https://api.salesforce.com/platform/mcp/v1/custom/CLOSASEGUROSDocumentos
Salesforce trace ID: 4ce0e661248148a5a3adda16c3192edc
Related: GitHub issues #251, #280, and forcedotcom/mcp-hosted#12

This is blocking daily operations for our whole team. Please escalate to Product Support.

### What did you expect to happen?

The connector should complete the OAuth authorization flow and connect successfully.

Specifically, after reading the Protected Resource Metadata (RFC 9728) — which returns HTTP 200 and declares authorization_servers: ["https://login.salesforce.com"] — the client should resolve that authorization server's metadata and redirect the browser to:

https://login.salesforce.com/services/oauth2/authorize

Since https://login.salesforce.com/.well-known/oauth-authorization-server returns 404 (Salesforce does not publish the RFC 8414 alias), the client should fall back to https://login.salesforce.com/.well-known/openid-configuration, which returns 200 with a valid authorization_endpoint and mcp_api listed in scopes_supported.

Instead, the client discards the declared authorization server and derives the endpoint from the resource origin, producing https://api.salesforce.com/authorize — a URL that does not exist and returns HTTP 404. The browser dies there, so the flow never returns to claude.ai and no ofid_ reference is generated.

### Steps to reproduce

1. In a Salesforce org, activate a custom Hosted MCP Server. Ours is exposed at:
https://api.salesforce.com/platform/mcp/v1/custom/CLOSASEGUROSDocumentos

2. Create an External Client App with:
- Callback URL: https://claude.ai/api/mcp/auth_callback
- OAuth scopes: mcp_api, refresh_token/offline_access, api, openid
- Authorization Code and Credentials Flow: enabled
- Require PKCE: enabled
- Issue JSON Web Token (JWT)-based access tokens for named users: enabled

3. In claude.ai, go to Organization settings > Connectors > Add custom connector (Web),
enter the MCP server URL above, and supply the External Client App's Consumer Key
and Consumer Secret under Advanced settings.

4. Click Connect.

5. The browser opens https://api.salesforce.com/authorize?response_type=code&client_id=...
&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=...
&code_challenge_method=S256&state=...&scope=mcp_api+refresh_token
&resource=https%3A%2F%2Fapi.salesforce.com%2Fplatform%2Fmcp%2Fv1%2Fcustom%2FCLOSASEGUROSDocumentos

→ HTTP 404. The Salesforce login screen is never reached.

Reproduces consistently. Also reproduced after fully removing and re-creating the
connector: identical failure with a fresh code_challenge, confirming it is not a
cached authorization state.

Server-side verification (all run from a terminal):

curl -i https://api.salesforce.com/platform/mcp/v1/custom/CLOSASEGUROSDocumentos
→ 401, body {"errors":[{"message":"JWT Token is required"}]}, no WWW-Authenticate header

curl -i https://api.salesforce.com/.well-known/oauth-protected-resource/platform/mcp/v1/custom/CLOSASEGUROSDocumentos
→ 200, authorization_servers: ["https://login.salesforce.com"],
scopes_supported: ["mcp_api","refresh_token"]

curl -i https://login.salesforce.com/.well-known/oauth-authorization-server
→ 404

curl -i https://login.salesforce.com/.well-known/openid-configuration
→ 200, authorization_endpoint: https://login.salesforce.com/services/oauth2/authorize,
mcp_api present in scopes_supported

Salesforce side confirmed working: pasting the correct authorize URL manually into a
browser — same client_id, redirect_uri, scope and PKCE parameters — returns the
Salesforce login screen as expected.

Salesforce trace ID: 4ce0e661248148a5a3adda16c3192edc
Related: #251, #280, forcedotcom/mcp-hosted#12

### Area

MCP Connector (adding/managing servers)

### MCP Server (if applicable)

_No response_

### Error messages or logs

```shell

```

### Additional context

_No response_