Local DDEV nginx denies all dotfile paths (including /.well-known/), blocking check 1 before it reaches WordPress -- an environment issue, not a WP-LIT-MCP/mcp-oauth defect. Check 1 now hits mcp-oauth's own discovery rewrite target (index.php?mcp_oauth_discovery=...) with a Host header derived from `wp option get home` as a HARD check, and separately probes the real /.well-known/ path as a non-failing ENVIRONMENT check that warns if the web server blocks it. Also adds --max-time 20 to every curl call so the script can never hang. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7