Outbound Apps: expose the console's MCP-URL DCR auto-discovery via the SDK/API

[tarracharan-glitch]

Hi Descope team — a gap between the console and the SDK/API for DCR outbound
apps.

In the console, creating a DCR outbound app needs only the MCP server
URL — Descope auto-discovers the OAuth endpoints (walks the discovery chain)
and registers the client; everything autofills on save.

Via the SDK/API there's no equivalent. Passing the resource URL as
discoveryUrl with useDcr: true fails:

await client.management.outboundApplication.createApplication({
  id, name,
  useDcr: true,
  discoveryUrl: "https://mcp.notion.com/mcp",
  defaultRedirectUrl: "https://api.descope.com/v1/outbound/oauth/callback",
});
// → E152006 "Failed to perform dynamic client registration" / "Failed to parse server URL"

So to register a DCR app programmatically, we have to reimplement the
discovery the console already does — walk
www-authenticate → oauth-protected-resource → authorization_servers →
.well-known/oauth-authorization-server → registration_endpoint, then pass
that as dcrUrl (a field that isn't even in the OutboundApplication type —
see #746).

Ask

Let createApplication accept the MCP resource URL for DCR and perform the
same MCP-aware discovery the console does, server-side — so consumers don't have
to re-derive the registration endpoint themselves. (Either teach discoveryUrl
to accept an MCP resource URL, or add an explicit mcpUrl/resourceUrl input.)

Environment

• @descope/node-sdk@2.8.0 (latest) and main.
• Related: OutboundApplication (createApplication) is missing useDcr/dcrUrl — but OutboundAppTemplateOverrides has them, forcing a cast for DCR apps #746 (useDcr/dcrUrl untyped), Support creating Outbound Apps from the preconfigured app library (templates) via the SDK #743/feat: create outbound app from template #744 (templates).

[talaharoni]

@tarracharan-glitch following #746 fix, when passing useDcr: true and the mcp server url under dcrUrl will act the same as from the console. no need to set the discoveryUrl in that case

[tarracharan-glitch]

Confirmed — works exactly as you described. Passing useDcr: true + dcrUrl: (no discoveryUrl) auto-discovers everything, same as the console. It worked on the currently-published SDK too, so the runtime behavior is already live (the #746 fix just removes the cast). This lets us delete our own discovery chain-walking entirely. Thanks for the quick turnaround — happy for this to be closed.