Patching the MCP SDK Doesn't Fix It. Pin the OAuth Issuer in TypeScript.
A developer published a TypeScript demonstration showing that patching the MCP SDK alone does not close an OAuth credential-leak class in MCP clients, since a client that discovers its authorization s…