mcporter invalid_scope: hardcoded mcp:tools OAuth scope breaks OIDC MCP servers

3 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Fixed on the main branch (maintainer comment dated 2026-04-18); the thread names no released version, and the issue is closed as completed. For mcporter 0.7.3, the thread's workaround is to patch the hardcoded scope in oauth.js line 63:

  diffCopy to clipboard

  - scope: 'mcp:tools',
  + scope: definition.oauthScope ?? '',
  

  Why it fails: PersistentOAuthClientProvider hardcodes scope: 'mcp:tools' in its client metadata. The MCP SDK's authInternal() falls back to that value when the server's WWW-Authenticate header is missing (the reporter notes AWS API Gateway remaps it to x-amzn-remapped-www-authenticate) and the protected resource metadata has no scopes_supported. Granola's authorization server advertises scopes_supported: ["email", "offline_access", "openid", "profile"], none of which include mcp:tools, so it rejects the request with invalid_scope and mcporter shows OAuth error: invalid_scope.

  Fix on main (per the maintainer): oauth.ts omits the scope by default so the SDK can derive it from server/auth metadata, and the config supports oauthScope (normalized from oauth_scope) for explicit provider scopes. Covered by tests/oauth-session.test.ts and tests/config-normalize.test.ts. If you're on main and a server needs a specific scope, set oauthScope in your mcporter config instead of patching the SDK.

  General advice: OAuth scopes define what permissions the token gets, so only request the scopes your MCP provider actually requires.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Reproduction from the issue body: mcporter auth granola --reset with mcporter 0.7.3 and SDK 1.25.3 against Granola MCP. The browser opened, Granola's auth server returned invalid_scope (the hardcoded mcp:tools scope is not in its advertised scopes), and mcporter reported OAuth error: invalid_scope.

  Source: https://github.com/openclaw/mcporter/issues/85 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @steipete tried on GitHub (Worked)

  Maintainer states the fix is on main: oauth.ts no longer hardcodes mcp:tools and omits scope by default so the SDK derives it from server/auth metadata, with oauthScope/oauth_scope config support; tests added in oauth-session.test.ts and config-normalize.test.ts, issue closed as completed.

  Source: https://github.com/openclaw/mcporter/issues/85#issuecomment-4274645156 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport