## Problem The `mcp_server_oauth` submodule declared a dependency on the umbrella `simple_oauth_21:simple_oauth_21` module. That umbrella module is a coordinator/dashboard with no functional code — its own only dependency is `simple_oauth`. As a result, enabling `mcp_server_oauth` did not auto-enable the functional submodules it actually relies on: `simple_oauth_server_metadata` (consumed by `ResourceMetadataSubscriber` for the RFC 9728 Protected Resource Metadata endpoint) and `simple_oauth_client_registration` (RFC 7591 dynamic client registration, which the MCP authorization spec requires for clients to register with the OAuth server). ## Expected Behavior Enabling `mcp_server_oauth` should automatically enable every Simple OAuth 2.1 submodule whose functionality is required to satisfy the MCP authorization spec, so RFC 9728 metadata discovery and RFC 7591 dynamic client registration work without administrators having to enable submodules manually. ## Steps to Reproduce 1. On a clean site, run `drush pm:enable mcp_server_oauth` (with `drupal/simple_oauth` and `e0ipso/simple_oauth_21` installed via Composer but no submodules enabled). 2. Observe that `simple_oauth_server_metadata` and `simple_oauth_client_registration` are not enabled. 3. Hit the `/.well-known/oauth-protected-resource` endpoint or attempt dynamic client registration; the server cannot fulfil either flow. ## Additional Context Fix in `modules/mcp_server_oauth/mcp_server_oauth.info.yml`: replace the `simple_oauth_21:simple_oauth_21` dependency with `simple_oauth_21:simple_oauth_server_metadata` and `simple_oauth_21:simple_oauth_client_registration`. The README's "Requirements" section should also be updated to reference the two specific submodules instead of the umbrella.