The client auth implementation for clients should check that the auth server implements PKCE, as described in https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/draft/basic/authorization.mdx?plain=1#L350-L356.