Skip to content

Jerome/fix/dev oauth server required scopes change #629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 17, 2025

Conversation

jerome3o-anthropic
Copy link
Member

@jerome3o-anthropic jerome3o-anthropic commented Jun 14, 2025

Removing required scope from the shttp dev oauth server. admittedly I don't know the best behaviour here:

  • Should the MCP client already know about the mcp:tools scope, and be requesting it?
  • Should the MCP client discover all available scopes and request all of them?
    • Should the user filter down the scopes to what they're comfortable (from the list of all available scopes) - is this something that should be handled MCP client side, or MCP server (& auth server) side
  • Or is this oauth server misconfigured - where requiring bespoke scopes to enable MCP connection is unadvised

As it currently stands, the inspector does both - guided flow requests all scopes, quick flow requests no scopes. I'm using this to test the inspector, and confused as to whether this oauth server is configured poorly (having required scopes for the MCP connection to function at all), or if the inspector quick flow is not functioning correctly (i.e. it should be requesting all available scopes)

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unrelated change to just get git blame working well in gitlens+vscode.

"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@modelcontextprotocol/sdk",
"version": "1.11.4",
"version": "1.12.3",
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also an unrelated change, just updating the lock to the latest version.

Copy link
Contributor

@cliffhall cliffhall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 👍 Fixes stubborn issue with inspector's OAuth reconnect problem when not going through debugger. That should get fixed as well, but arguably this works as well in the near term.

@pcarleton pcarleton merged commit 8b9aa20 into main Jun 17, 2025
5 checks passed
@pcarleton pcarleton deleted the jerome/fix/dev-oauth-server-required-scopes-change branch June 17, 2025 09:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants