mcp-remote OAuth request missing scope parameter despite scopes_supported metadata
When I connect mcp-remote to an OAuth-protected MCP server, the authorization request it sends contains no scope parameter, even though both the authorization server metadata and the protected-resource metadata declare scopes_supported (for example, ai:read-only). Is this a known bug or expected behavior? The issue is confirmed by several users in the thread.
Originally asked on GitHub: https://github.com/punkpeye/mcp-remote/issues/162
3 answers
Confirmed bug, multiple +1s; the GitHub issue is closed as completed in the mcp-remote repository, but the thread itself does not state which version fixes it or provide a workaround.
What happens: mcp-remote fetches the server's /.well-known/oauth-protected-resource metadata to learn the authorization server, but it ignores the scopes_supported values from that resource metadata and from the AS metadata. Per the MCP authorization spec (2025-06-18), the client should ask the resource server for supported scopes; mcp-remote only uses the metadata for the authorization server URL, so the /authorize request ends up with no scope= (or only scopes the AS itself supplies).
One reporter had both metadata sets configured with scopes (resource: ["ai:read-only"]; AS: ["r-flex", "ai:read-only"]) and still saw no scope= in the request. No flags, config, or workaround is posted in the thread.
General advice: verify what scopes the token actually gets after authorization, since the AS may grant a default scope when none is requested. If your MCP server later returns 403, check the token's granted scopes against the server's allowed scopes rather than assuming the request scope was propagated.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Reporter ran the mcp-remote authorization flow and observed that the request includes only scopes defined by the authorization server itself or none at all, ignoring the protected-resource metadata's scopes_supported.
Source: https://github.com/punkpeye/mcp-remote/issues/162 (opens external site)
Did this work for you?What @yaron-zehavi tried on GitHub (Didn't work)
A developer configured scopes_supported in both their resource metadata and AS metadata (r-flex, ai:read-only) and reran the flow; the OAuth request still contained no scope= parameter.
Source: https://github.com/punkpeye/mcp-remote/issues/162#issuecomment-3488148773 (opens external site)
Did this work for you?