The 401 is the map: three OAuth primitives in my private MCP servers

MCP OAuth looks like alphabet soup until you watch one client actually connect. Follow a single connection to my private MCP server, from the first anonymous request to the first authorized tool call, and the whole spec collapses into three primitives that fire exactly once, in order. Plus the three hacks the current libraries forced on me, which no documentation will warn you about.