Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From prodsec-skills
Handles OAuth scope discovery and negotiation in MCP clients using WWW-Authenticate headers and Protected Resource Metadata. Useful when building or reviewing MCP client authorization flows.
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:oauth-scopes-handlingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
MCP clients MUST discover and use OAuth scopes from the WWW-Authenticate header or Protected Resource Metadata when authenticating to MCP servers. Scopes define the permissions the client is requesting and MUST be handled as follows:
Enforces OAuth 2.0 Protected Resource Metadata (RFC 9728) in MCP clients for authorization server discovery. Use when building or reviewing MCP client authentication flows.
Implements auth scopes on tools/resources and configures auth modes (none/jwt/oauth) for `@cyanheads/mcp-ts-core`. Use when adding declarative or dynamic authorization to MCP handlers.
Implements MCP server authentication using OAuth dynamic client registration (RFC 7591/8414), PKCE, bearer tokens, and API keys for admin UIs. Supports per-agent credentials, metadata discovery, token exchange, and tool sync for providers like Linear, Sentry.
Share bugs, ideas, or general feedback.
MCP clients MUST discover and use OAuth scopes from the WWW-Authenticate header or Protected Resource Metadata when authenticating to MCP servers. Scopes define the permissions the client is requesting and MUST be handled as follows:
scope parameter in the WWW-Authenticate header of a 401 response, it MUST use those scopes.scopes_supported in the Protected Resource Metadata (PRM) document.1. MCP client attempts to access MCP server resource
2. MCP server returns 401 Unauthorized with:
WWW-Authenticate: Bearer realm="mcp", scope="tools:read tools:execute"
3. MCP client extracts scope from WWW-Authenticate header
→ If scope present: use those scopes for authorization request
→ If scope absent: fetch PRM and use scopes_supported
4. MCP client requests authorization with the discovered scopes
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="mcp-server",
scope="tools:read tools:execute resources:read"
The client should request exactly these scopes (or a subset) from the authorization server.
scope parameter from WWW-Authenticate header on 401 responsesscopes_supported from Protected Resource Metadata if no scope in 401