Transport-agnostic core of the MCP OAuth callback handler, shared by the browser Express route and
the Electron loopback server. It keeps the security-relevant logic in one audited place:
state-bound dispatch into MCPOAuthCallbackService, HTML-escaping and length-capping of
reflected authorization-server errors, and the locked-down response headers. Each transport only
parses its query into MCPOAuthCallbackQuery and writes the returned MCPOAuthCallbackResponse.
Transport-agnostic core of the MCP OAuth callback handler, shared by the browser Express route and the Electron loopback server. It keeps the security-relevant logic in one audited place:
state-bound dispatch into MCPOAuthCallbackService, HTML-escaping and length-capping of reflected authorization-server errors, and the locked-down response headers. Each transport only parses its query into MCPOAuthCallbackQuery and writes the returned MCPOAuthCallbackResponse.