OAuth Scopes Handling in MCP Clients

Security Requirement

MCP clients MUST discover and use OAuth scopes from the WWW-Authenticate header or Protected Resource Metadata when authenticating to MCP servers. Scopes define the permissions the client is requesting and MUST be handled as follows:

Scope Discovery Priority

1. WWW-Authenticate header: If the MCP client receives a scope parameter in the WWW-Authenticate header of a 401 response, it MUST use those scopes.
2. Protected Resource Metadata: If no scope is provided in the 401 response, check scopes_supported in the Protected Resource Metadata (PRM) document.

Flow