[Question]: Title: OAuth authorization server metadata issuer mismatch (RFC 8414 3.3) connecting to platform/sobject-reads

### Your question

Unable to connect any MCP client to a hosted MCP server on a production Enterprise org. The failure is in the OAuth discovery layer, before credentials are evaluated.

**Environment**
- Production Enterprise Edition
- MCP Servers page: platform/sobject-reads shows Active
- Server URL tested: https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads
- Also tested: https://api.salesforce.com/platform/mcp/v1/sobject-reads

**External Client App**
- Created per https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/claude.html
- Callback URL: https://claude.ai/api/mcp/auth_callback
- Scopes: mcp_api, refresh_token, api, sfap_api
- Flow Enablement: Enable Authorization Code and Credentials Flow
- Security: Issue JSON Web Token (JWT)-based access tokens for named users
- App Status: Enabled, OAuth Status enabled, confirmed via OAuth Usage

**Error, MCP Inspector**

Failed to connect to "Salesforce"
Issuer mismatch in authorization server metadata (RFC 8414 3.3): expected "https://api.salesforce.com:443/platform/mcp/v1/platform/sobject-reads", received "https://login.salesforce.com"

**Error, Claude custom connector**

OAuth handshake completes. Salesforce issues a token and OAuth Usage shows the app connected with user count 1. Claude then returns:

Authorization with Salesforce MCP failed. You can check your credentials and permissions.

Anthropic trace references: ofid_7ad13b55d164db5f, ofid_ebe599db1f8d2738, ofid_0f81db3e0c5f49ed

**Assessment**

Inspector derives the expected issuer from the resource URL, fetches authorization server metadata, and receives a document declaring the issuer as https://login.salesforce.com. RFC 8414 3.3 requires the issuer in the metadata to match the identifier used for discovery, so the client rejects it before any credential exchange.

This suggests either that protected resource metadata (RFC 9728) is not being served for the MCP resource, so clients cannot discover login.salesforce.com as the legitimate authorization server, or that the authorization server metadata issuer value is not aligned with the discovery path.

Credentials, scopes, flow settings, and URL path have been varied and do not change the outcome, consistent with a discovery-layer issue rather than a configuration one.

**Question**

Is there a documented client requirement or org setting to make discovery resolve correctly, or is this a known gap in metadata served for hosted MCP endpoints? Steps to reproduce with MCP Inspector are above and reproduce consistently.

### Context

_No response_

### Environment

_No response_

Start with the MCP Inspector reproduction against the hosted MCP URL and compare the authorization server metadata with the RFC 8414 issuer requirement. The issue is done when the discovery behavior is corrected or the required client or org configuration is documented; no repository file or test is named.

Written by the indexing model from the issue text.