What's broken?

The spec conflicts with an RFC or standard it references

Where in the spec or docs?

https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration#client-id-metadata-documents

What should happen?

Redirect URIs using localhost go against recommendations given by Section 8.3 of OAuth 2.0 for Native Apps [RFC 8252].

Specifying a redirect URI with the loopback IP literal rather than localhost avoids inadvertently listening on network interfaces other than the loopback interface. It is also less susceptible to client-side firewalls and misconfigured host name resolution on the user's device.

What actually happens?

The example needs to include 127.0.0.1 for IPv4 and [::1] for IPv6 in redirect URIs.

Anything else?

No response