196 pages for scopes.

MCP, plugins, skills, and hooks Claude Documentation · in the page third-party/claude-desktop/extensions …e-desktop/configuration.md#managedmcpservers) to change the requested scopes. If the authorization server rejects a refresh, or issued no refresh token and the access token expires, the server returns… Deploy Claude Desktop on 3P with an LLM gateway Claude Documentation · in the page third-party/claude-desktop/gateway …microsoftonline.com/YOUR_TENANT_ID/v2.0` | | Gateway SSO IdP (OIDC) → Scopes | *leave empty for the default* | | Gateway SSO IdP (OIDC) → Redirect port | *leave empty* | Then click **Export** to prod… Set up sign-in for managed MCP servers Claude Documentation · in the page third-party/claude-desktop/mcp-sign-in …* | Required with **Tenant ID**. Optional otherwise | Space-separated scopes for the authorize request. Leave empty to request the scopes the server advertises | | **Sign-in flow** | Shown after you e… Deploy Claude Desktop on 3P with Google Cloud's Agent Platform Claude Documentation · in the page third-party/claude-desktop/vertex …Workspace and do not require Google verification, regardless of which scopes they request. If the project is not in a Workspace organization, you must use the **External** user type. Because this flo… Authorization Charter Model Context Protocol · in the page community/interest-groups/auth …nularity**: whether and how MCP servers should advertise fine-grained scopes (per-tool, per-resource) and how clients should request and present them, and authorization granularity beyond scope string… Financial Services Charter Model Context Protocol · in the page community/interest-groups/financial-services …ancial sector, develops and validates domain-specific extensions, and scopes problems with broad applicability into [SEPs](/community/sep-guidelines.md) or Working Groups so that innovations proven in… Scientific Computing Charter Model Context Protocol · in the page community/interest-groups/scientific-computing …rotocol work * **Authorization and identity mechanics**: OAuth flows, scopes, and token handling belong to the [Authorization IG](/community/interest-groups/auth.md) ### Related Groups * **[Tasks… Security Charter Model Context Protocol · in the page community/interest-groups/security …talogs MCP-specific threats, reviews security-relevant proposals, and scopes validated problems into focused Working Groups or [SEPs](/community/sep-guidelines.md). ## Scope ### In Scope * **Threat… Understanding Authorization in MCP Model Context Protocol · in the page docs/2024-11-05/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/2024-11-05/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Understanding Authorization in MCP Model Context Protocol · in the page docs/2025-03-26/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/2025-03-26/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Understanding Authorization in MCP Model Context Protocol · in the page docs/2025-06-18/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/2025-06-18/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Understanding Authorization in MCP Model Context Protocol · in the page docs/2025-11-25/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/2025-11-25/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Authorization Model Context Protocol · in the page docs/2026-07-28/tools/inspector/authorization …cted-resource metadata URL (`resource_metadata`) and, optionally, the scopes the request requires. **2. Discover the authorization server** The Inspector fetches the server's [protected-resource and… TUI client Model Context Protocol · in the page docs/2026-07-28/tools/inspector/tui …ed. Per-server OAuth fields in the catalog (static client id/secret, scopes, the enterprise-managed flag) are applied automatically. Install-wide settings (CIMD, enterprise IdP) come from `~/.mcp-ins… Web client Model Context Protocol · in the page docs/2026-07-28/tools/inspector/web …istered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, additional authorization parameters, authorizat… Understanding Authorization in MCP Model Context Protocol · in the page docs/2026-07-28/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/2026-07-28/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Authorization Model Context Protocol · in the page docs/draft/tools/inspector/authorization …cted-resource metadata URL (`resource_metadata`) and, optionally, the scopes the request requires. **2. Discover the authorization server** The Inspector fetches the server's [protected-resource and… TUI client Model Context Protocol · in the page docs/draft/tools/inspector/tui …ed. Per-server OAuth fields in the catalog (static client id/secret, scopes, the enterprise-managed flag) are applied automatically. Install-wide settings (CIMD, enterprise IdP) come from `~/.mcp-ins… Web client Model Context Protocol · in the page docs/draft/tools/inspector/web …istered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, additional authorization parameters, authorizat… Understanding Authorization in MCP Model Context Protocol · in the page docs/draft/tutorials/security/authorization …fetch the metadata to learn about the authorization server, supported scopes, and other resource information. The data is typically encapsulated in a JSON blob, similar to the one below. ```json them… Security Best Practices Model Context Protocol · in the page docs/draft/tutorials/security/security_best_practices …requesting MCP client by name * Display the specific third-party API scopes being requested * Show the registered `redirect_uri` where tokens will be sent * Implement CSRF protection (e.g., state par… Enterprise-Managed Authorization Model Context Protocol · in the page extensions/auth/enterprise-managed-authorization …ion-level settings rather than per-user settings. 5. **Respect token scopes** — tokens issued by enterprise IdPs may have scope restrictions that differ from standard MCP authorization. Handle scope… OAuth Client Credentials Model Context Protocol · in the page extensions/auth/oauth-client-credentials …ation server's public keys (usually via a JWKS endpoint). **2. Check scopes** Ensure the token includes the required scopes for the requested operation. **3. Advertise support** Optionally (but re… How to Automate Publishing with GitHub Actions Model Context Protocol · in the page registry/github-actions …itHub Personal Access Token (PAT) that has `read:org` and `read:user` scopes. * **DNS Authentication**: Add a `MCP_PRIVATE_KEY` secret with your Ed25519 private key. You may also need to add secrets… SEP-1302: Formalize Working Groups and Interest Groups in MCP Governance Model Context Protocol · in the page seps/1302-formalize-working-groups-and-interest-groups-in-mc …t Group + some WGs: client-registration, improve-devx, profiles, tool-scopes * Agents --> Working Group \[Long Running / Async Tool Calls; unless we want an Agents IG on top of that?] * Connection Lif… SEP-2207: OIDC-Flavored Refresh Token Guidance Model Context Protocol · in the page seps/2207-oidc-refresh-token-guidance …eader's `scope` parameter or in the Protected Resource Metadata's `scopes_supported` would be semantically incorrect since it implies the resource *requires* refresh tokens, which it never wo… SEP-2567: Sessionless MCP via Explicit State Handles Model Context Protocol · in the page seps/2567-sessionless-mcp …corresponding benefit. Under this proposal, a server that currently scopes a shopping cart (for example) to the session instead exposes a tool `create_basket()` that returns a `basket_id` and thread… SEP-985: Align OAuth 2.0 Protected Resource Metadata with RFC 9728 Model Context Protocol · in the page seps/985-align-oauth-20-protected-resource-metadata-with-rf …ation easier (e.g. you make a request for a tool, but need additional scopes, and receive a WWW-Authenticate challenge indicating the scopes). Based on the above, following the updated flow: * Attem… Authorization Model Context Protocol · in the page specification/2025-03-26/basic/authorization …Authorization required or token invalid | | 403 | Forbidden | Invalid scopes or insufficient permissions | | 400 | Bad Request | Malformed authorization request | ### Implementation Requirements 1.… Authorization Model Context Protocol · in the page specification/2025-06-18/basic/authorization …Authorization required or token invalid | | 403 | Forbidden | Invalid scopes or insufficient permissions | | 400 | Bad Request | Malformed authorization request | ## Security Considerations Implemen… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …ps://datatracker.ietf.org/doc/html/rfc6750#section-3) to indicate the scopes required for accessing the resource. This provides clients with immediate guidance on the appropriate scopes to request dur… Authorization Server Discovery Model Context Protocol · in the page specification/2026-07-28/basic/authorization/authorization-server-discovery …`scope` parameter in the `WWW-Authenticate` challenge to indicate the scopes required for accessing the resource; the scope semantics and the associated client behavior are defined in the [Scope Selec… Authorization Model Context Protocol · in the page specification/2026-07-28/basic/authorization/index …ps://datatracker.ietf.org/doc/html/rfc6750#section-3) to indicate the scopes required for accessing the resource. This provides clients with immediate guidance on the appropriate scopes to request dur… Prompts Model Context Protocol · in the page specification/2026-07-28/server/prompts …equest — for example, returning only the prompts the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Prompts To retr… Resources Model Context Protocol · in the page specification/2026-07-28/server/resources …uest — for example, returning only the resources the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Resources To di… Tools Model Context Protocol · in the page specification/2026-07-28/server/tools …request — for example, returning only the tools the caller's granted scopes permit — since credentials are per-request input, not connection state. Servers **SHOULD** return tools in a deterministic… Authorization Server Discovery Model Context Protocol · in the page specification/draft/basic/authorization/authorization-server-discovery …`scope` parameter in the `WWW-Authenticate` challenge to indicate the scopes required for accessing the resource; the scope semantics and the associated client behavior are defined in the [Scope Selec… Authorization Model Context Protocol · in the page specification/draft/basic/authorization/index …ps://datatracker.ietf.org/doc/html/rfc6750#section-3) to indicate the scopes required for accessing the resource. This provides clients with immediate guidance on the appropriate scopes to request dur… Prompts Model Context Protocol · in the page specification/draft/server/prompts …equest — for example, returning only the prompts the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Prompts To retr… Resources Model Context Protocol · in the page specification/draft/server/resources …uest — for example, returning only the resources the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Resources To di… Tools Model Context Protocol · in the page specification/draft/server/tools …request — for example, returning only the tools the caller's granted scopes permit — since credentials are per-request input, not connection state. Servers **SHOULD** return tools in a deterministic…