feat: add MCP server subcommand for AI-assisted token retrieval

Add `oidc mcp` subcommand that starts a stdio-based MCP server using the
rmcp crate, exposing `list_clients` and `get_token` tools. This allows AI
assistants like Claude Code to retrieve OIDC tokens for configured clients.

The MCP functionality is behind a default-enabled `mcp` feature flag so it
can be excluded when not needed. Also adds cargo-all-features to CI to
verify all feature combinations compile.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ctron

.github/workflows/ci.yaml

@@ -96,11 +96,29 @@ jobs:
       - name: Test
         run: cargo +${{ matrix.rust }} test --workspace ${{ matrix.args }} -- --nocapture
 
+  features:
+    needs: fmt
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install dependencies
+        run: sudo apt install -y libssl-dev
+
+      - name: Install cargo-all-features
+        run: cargo install cargo-all-features
+
+      - name: Check all feature combinations
+        run: cargo check-all-features
+
   ci:
     runs-on: ubuntu-latest
     needs:
       - fmt
       - test
+      - features
     if: always()
     steps:
       - name: Success

Cargo.lock

@@ -37,6 +37,8 @@ openidconnect = { version = "4", features = ["accept-rfc3339-timestamps"] }
 oauth2 = "5"
 pretty-hex = "0.4.1"
 reqwest = "0.12" # keep aligned with openidconnect
+rmcp = { version = "2", features = ["server", "transport-io", "macros"], optional = true }
+schemars = { version = "1", optional = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
@@ -48,6 +50,8 @@ url = "2"
 openssl = "0.10" # transient dependency, required for vendoring
 
 [features]
+default = ["mcp"]
+mcp = ["dep:rmcp", "dep:schemars"]
 vendored = [
     "openssl/vendored"
 ]

Cargo.toml

@@ -79,6 +79,31 @@ This also works with `curl`:
 curl http://example.com/api -H $(oidc token -H my-client)
 ```
 
+## MCP Server
+
+`oidc-cli` includes a built-in [MCP](https://modelcontextprotocol.io/) server that lets AI assistants retrieve OIDC
+tokens for configured clients. This is useful when you want AI-powered tools to make authenticated API calls on your
+behalf.
+
+First, set up your OIDC clients as usual (see above). Then start the MCP server:
+
+```bash
+oidc mcp
+```
+
+The server communicates over stdio and exposes two tools:
+
+* **`list_clients`** — lists all configured OIDC clients with their issuer URL and token status
+* **`get_token`** — retrieves a valid token for a named client, automatically refreshing if expired
+
+### Claude Code
+
+To register the MCP server with [Claude Code](https://docs.anthropic.com/en/docs/claude-code):
+
+```bash
+claude mcp add oidc -- oidc mcp
+```
+
 ## More examples
 
 Create a public client from an initial refresh token. This can be useful if you have a frontend application, but no