Claude 0d1ba97145 feat(oauth-provider): answer insufficient scope with a 403 insufficient_scope challenge ...

Per the MCP 2026-07-28 scope-challenge guidance (RFC 6750 §3.1),
raiseResourceServerChallenge now maps FORBIDDEN errors to a 403 with a
WWW-Authenticate challenge carrying error="insufficient_scope", the
required scope, and the resource_metadata pointer so MCP clients can
step up their authorization. requireMcpAuth and mcpHandler gain a
`scopes` option enforced against the token's scope claim, and awaited
handlers let handler-thrown FORBIDDEN errors produce the same challenge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbU1ZgRHK5A1btqpdR5gbD

2026-07-28 19:31:09 +00:00

..

blogs

chore(sync): merge main into next

2026-07-22 10:39:55 -04:00

changelogs

chore(docs): format markdown including mdx files (#9085)

2026-04-10 05:09:33 +00:00

docs

feat(oauth-provider): answer insufficient scope with a 403 insufficient_scope challenge

2026-07-28 19:31:09 +00:00

docs-beta

docs: add stable/beta versioning with build-time content sync (#9258)

2026-04-21 03:49:33 +00:00