This issue tracks implementing SEP-837 in the client OAuth flow.

SEP-837 requires MCP clients to specify an application_type during OIDC Dynamic Client Registration. When it is omitted, OIDC-compliant authorization servers default the client to "web", which conflicts with the loopback (localhost, 127.0.0.1, ::1) redirect URIs that native clients (CLI and desktop apps) use, so the server can reject the registration.

Currently OAuthClientMetadata has no application_type field and create_client_registration_request never sends one, so the client hits exactly this default.

Spec: Application Type and Redirect URI Constraints