createmcps.com

MCP-AUT-006

WWW-Authenticate includes a scope parameter

“MCP servers SHOULD include a scope parameter in the WWW-Authenticate header as defined in RFC 6750 Section 3.” — spec anchor

How to fix this

Add a `scope` parameter to the `WWW-Authenticate` challenge (RFC 6750 §3). Without it the client has to guess which scopes to request, and a wrong guess costs the user a round trip through consent.

Example: failing and passing

The 401 challenge points to the metadata but does not say which scopes the request needs.
Violates MCP-AUT-006 · HTTP
POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
...

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
The challenge adds a scope parameter naming the scopes required, as in the spec's own example.
Complies with MCP-AUT-006 · HTTP
POST /mcp HTTP/1.1
Host: mcp.example.com
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/list
...

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource",
                         scope="files:read"

How the validator checks this

Probe P8.1, against a streamable-http server on the modern protocol. What it reports:

pass
Challenge names the scopes required
warn
WWW-Authenticate has no scope parameter, so a client must guess which scopes to request

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked deterministically: a fail here is a certain violation, not an inference.

Checked in the same request as MCP-AUT-001, MCP-AUT-007, MCP-AUT-008, MCP-SEC-007.

Check your own server against MCP-AUT-006

Probe P8.1 checks MCP-AUT-006 in the same request as 4 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: how to add OAuth to an MCP server.

Other Authorization rules

  • MCP-AUT-001Unauthenticated request returns 401 with WWW-Authenticate resource_metadata
  • MCP-AUT-002RFC 9728 Protected Resource Metadata is served and valid
  • MCP-AUT-003PRM resource equals the canonical server URI
  • MCP-AUT-004Each listed authorization server exposes RFC 8414 or OIDC discovery metadata
  • MCP-AUT-005AS advertises authorization_response_iss_parameter_supported: true
  • MCP-AUT-007Insufficient scope returns 403 with error="insufficient_scope"
  • MCP-AUT-008Tokens with a foreign audience are rejected
  • MCP-AUT-009offline_access absent from scopes_supported / challenge scope
  • MCP-AUT-010AS advertises S256 in code_challenge_methods_supported
  • MCP-AUT-011AS supports Client ID Metadata Documents, not DCR alone