The 401 section is useful. A redirect to the login page looks fine in a browser, so it is easy to miss that MCP clients break on it. Keeping tokens read-only and storing only the hash is the right call too. Did the directory health checks pass once you returned the 401, or do some still look for OAuth discovery?