OAuth2: Protected-resource URL passed as scope instead of parsed scope #1630
{{ message }}
Content-Length: 271911 | pFad | https://github.com/modelcontextprotocol/python-sdk/issues/1630
95Fetched URL: https://github.com/modelcontextprotocol/python-sdk/issues/1630
Alternative Proxies:
Initial Checks
Description
I noticed that the scope parameter is being set to the OAuth protected-resource URL instead of the parsed scope (or None when no scope is provided).
After inspecting the code, it seems the URL is passed directly as the scope here:
python-sdk/src/mcp/client/auth/oauth2.py
Lines 508 to 512 in 9724ad1
This results in an incorrect scope value being propagated during OAuth2 authentication.
Example Code
Python & MCP Python SDK