MCP server · Authorization
403 insufficient_scope for step-up
When a valid token lacks a required scope the server answers 403 with error="insufficient_scope" and the scopes needed, enabling step-up authorization.
mcp.rs.insufficient-scope
In revision 2026-07-28
- Level
- SHOULD
- Defined in
- Authorization › Scope Challenge HandlingMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
activeOnly observable by sending requests to the server; recorded by hand or by a future active scanner, never by this site.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | SHOULD | Authorization › Scope Challenge Handling |
| 2025-11-25 | SHOULD | Authorization Flow › Scope Challenge Handling |
Adoption across listed servers
- Supported0
- Partial0
- Unsupported0
- Unknown34
- Not applicable5