> The MCP authorization spec is written entirely around user-delegated flows and does not define a machine-to-machine grant at all.

is slightly wrong. There's a blessed extension: https://modelcontextprotocol.io/extensions/auth/oauth-client...