mcp-oauth-scope-selectio-when-an-mcp-client-performs-oauth-authorization-wi-c2708bf2

THEN Implement a three-step scope selection strategy: first use any scope provided in a 401 WWW-Authenticate challenge header; if none, omit the scope parameter so the server uses its defaults; if the server returns an invalid_scope error, fall back to requesting all supported_scopes. Also update the server to provide default scopes when scope is omitted for better interop.

// Pseudocode for scope selection
function determineScope(response, supportedScopes, clientDefaultScope) {
  const challengeScope = extractChallengeScope(response);
  if (challengeScope) return challengeScope;
  if (clientDefaultScope) return clientDefaultScope;
  // Omit scope, let server default
  return undefined;
}
function handleInvalidScopeError(supportedScopes) {
  // Fallback: request all scopes
  return supportedScopes.join(' ');
}