I scanned 25 public MCP servers. Here is what the OAuth 2.1 posture looks like in the wild, and the auditor I built to measure it.