MCP server · Authorization
Scope in the WWW-Authenticate challenge
The 401 challenge includes a scope parameter naming the scopes a client should request.
In revision 2026-07-28
- Level
- SHOULD
- Defined in
- Authorization › Scope Selection StrategyMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
passiveObservable by reading published metadata, without any request to the server.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | SHOULD | Authorization › Scope Selection Strategy |
| 2025-11-25 | SHOULD | Authorization Flow › Scope Selection Strategy |
Adoption