Rack bearer-token middleware (RFC 6750), OAuth protected-resource and authorization-server metadata endpoints (RFC 9728 / RFC 8414), and an AuthProvider for delegated token exchange in MCP servers. Wraps no MCP SDK; attaches to any Rack app, including servers built on the official mcp gem.