Goose should initiate oauth flow in response to 401/www-authenticate from any messages, not just initialization

[jamadeo]

This might need some work in rmcp

[zhaohuabing]

Yeah, I ran into the same issue. It seems that Goose OAuth is following the outdated 202503-26 version of spec.

[kentcdodds]

Yes please! This is highly irritating when developing a server that requires auth.

[zanesq]

checking if this is still in progress?

[jamadeo]

@zanesq I don't know of anything in progress for this on the goose side specifically, but rmcp has seen a decent amount of recent oauth-related development: https://github.com/modelcontextprotocol/rust-sdk/pulls?q=is%3Apr+oauth