Whether this client currently has OAuth access tokens.
Mixed auth means public MCP operations succeeded while OAuth is available.
OptionalresourceCanonical protected-resource identifier from RFC 9728 metadata.
OptionalscopesScopes advertised by the protected resource, when provided.
OAuth availability inferred after an anonymous MCP connection succeeds.