Bump auth SDK to use Improved AS Discovery

[2underscores]

Bump the MCP SDK pin from ^1.17.0 to ^1.17.2, to update the debugger to the latest AS metadata endpoint discovery method (discoverAuthorizationServerMetadata introduced in modelcontextprotocol/typescript-sdk#652) and include the CORS retry bug fix introduced in 1.17.2 (modelcontextprotocol/typescript-sdk#827).

Motivation and Context

Needed to connect Inspector's auth debugger to MCP servers that use Azure for AS. Needed support for metadata at /.well-known/openid-configuration, and needed CORS fix so it didn't fail on earlier attempted incorrect endpoints.

How Has This Been Tested?

Run all tests locally (and needed to update the mocks to the new method).
As tests were changed, also manually tested against an OOB MCP server (Neon's) and a custom one using Azure AD.

Breaking Changes

• It shouldn't, bump to SDK is within same major version.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Related Issues

I suspect this will resolve these issues that are all related to metadata:

• Incorrect constructor for OAuth metadata URL #700
• The inspector does not follow the spec according to authorization senarios #675
• Metadata discovery - handling openid-configuration not just oauth-authorization-server #563
  • Steps explicitly use guided flow here so I'm sure it resolves this.
• HTTP 405 trying to load well-known OAuth metadata #634
  • Latest comment on there mentions the that discovery method in base SDK not being in inspector yet.

[olaservo]

Thanks for the PR - I took a look at the linked sdk fixes and just wanted to confirm that swapping in this new method should be backwards compatible with auth flows that were already working with the debugger before this?

[pcarleton]

👍 this should be backwards compatible.

the change to the new function was to support OIDC metadata, and also there were some fixes to retries, but interface is the same and existing metadata discovery should be unchanged

[cliffhall]

LGTM! 👍