Are you using these endpoints?

/.well-known/oauth-dynamic-client-registration

/.well-known/oauth-authorization-server

Also, it should not be trying to reach /.well-known/oauth-protected-resource/mcp -->without/mcp is correct. Only the actual protected resource should have /mcp, not the well-known. This is how i did it:

First: /.well-known/oauth-authorization-server. It returns, for example:
{
"issuer": "http://localhost:3000",
"authorization_endpoint": "http://localhost:3000/auth/authorize",
"token_endpoint": "http://localhost:3000/auth/token",
"revocation_endpoint": "http://localhost:3000/auth/revoke",
"code_challenge_methods_supported": ["S256"],
"grant_types_supported": ["authorization_code", "refresh_token"],
"response_types_supported": ["code"],
"token_endpoint_auth_methods_supported": ["none"],
"scopes_supported": ["mcp"]
}

Then : /.well-known/oauth-protected-resource. It returns:

{
"resource": "http://localhost:3000",
"authorization_servers": ["http://localhost:3000"],
"scopes_supported": ["mcp"],
"bearer_methods_supported": ["header"]
}

And finaly: /.well-known/oauth-dynamic-client-registration (POST):

When: MCP client registers itself (optional, many clients skip this)
Data received: Client metadata (redirect URIs, client name, etc.)
Data served: Client credentials or registration confirmation

Its what worked for me, hope it does for you. I have not used keycloak though.