No RFC 9728 metadata at /.well-known/oauth-protected-resource. Publish it so agents can discover required scopes without hand-coded credentials.
Remediation
Failing: discoverability.oauth_protected_resource
discoverability.oauth_protected_resourcemedium
no auto-generated snippet for this check. See remediation below.
Why and how