This is an MCP gateway: an OAuth client of Kanidm upstream, and an authorization server to a local MCP client downstream. The local client at https://mcp-client.lab.quokkahost.com connects through it.
The interesting endpoint is /authorize: watch whether it
checks the redirect_uri it is handed. The attack and the fix
both live there.
Allow-listed downstream redirect(s):
[ "https://mcp-client.lab.quokkahost.com/callback" ]