All review findings addressed. Zero known gaps against SEP-2127.
- Auth.Schemes normalization: nil is converted to empty slice in Build(), so JSON output is always
"schemes":[]never"schemes":null - WellKnownPathFor(card): returns per-server well-known path for multi-server hosts (
/.well-known/mcp-server-card/{name}) - Rate limiting docs: Handler godoc notes callers must apply rate limiting middleware
- 14 tests, zero lint issues