[calbebop]

Summary

• Detect predictable UUID-shaped task counters without counting fixed formatting as entropy.
• Follow MCP OAuth challenges and path-specific metadata to validated, approved issuers without sending the scan token to metadata URLs.
• Reject missing or unsupported OAuth token types before using them as Bearer.

Validation

• go test ./...
• go test -race ./internal/attack ./internal/attack/mcp ./internal/auth ./internal/cli
• go vet ./...

Roadmap: #558. Repeated-handle deduplication remains open.