MCP server · Authorization
Scope in the WWW-Authenticate challenge
The 401 challenge includes a scope parameter naming the scopes a client should request.
mcp.rs.scope-challenge
In revision 2026-07-28
- Level
- SHOULD
- Defined in
- Authorization › Scope Selection StrategyMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
activeOnly observable by sending requests to the server; recorded by hand or by a future active scanner, never by this site.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | SHOULD | Authorization › Scope Selection Strategy |
| 2025-11-25 | SHOULD | Authorization Flow › Scope Selection Strategy |
Adoption across listed servers
- Supported0
- Partial0
- Unsupported0
- Unknown34
- Not applicable5