Separate OAuth callback readiness from request deadlines

Publish OAuth authorization readiness only after the loopback callback listener is accepting connections. Give interactive authorization a separate bounded initialization budget from ordinary API calls; otherwise a short MCP request timeout can tear down the callback listener while the user is still granting consent. Keep callback state validation, normal TLS checks, narrow scopes and bounded post-login identity/refresh checks. Log only safe phase and exception categories, never auth codes or tokens. This applies to local OAuth bootstrap helpers; it does not justify unlimited timeouts or broadened grants.

Applies when: A local OAuth helper launches browser consent before an MCP connection has fully initialized. Keywords: OAuth callback loopback readiness timeout MCP initialization consent bootstrap