@platformatic/mcp 2.2.0 accepts requiredScopes for token validation, but it does not publish them in either OAuth protected-resource metadata response and its initial 401 Bearer challenge omits scope.\n\nThis prevents MCP clients from discovering a resource-specific scope when the authorization server's issuer metadata only lists generic OpenID scopes.\n\nProposed minimal change:\n\n1. Include scopes_supported: authConfig.requiredScopes in both /.well-known/oauth-protected-resource routes and their response schemas.\n2. Make generateWWWAuthenticateHeader use config.requiredScopes when the caller does not supply a scope.\n\nI have a small compiled-dist patch and Fastify integration coverage for the metadata response and unauthenticated challenge. This is related to #179, which tracks our other 2.2.0 resource-server fixes.
@platformatic/mcp 2.2.0 accepts requiredScopes for token validation, but it does not publish them in either OAuth protected-resource metadata response and its initial 401 Bearer challenge omits scope.\n\nThis prevents MCP clients from discovering a resource-specific scope when the authorization server's issuer metadata only lists generic OpenID scopes.\n\nProposed minimal change:\n\n1. Include scopes_supported: authConfig.requiredScopes in both /.well-known/oauth-protected-resource routes and their response schemas.\n2. Make generateWWWAuthenticateHeader use config.requiredScopes when the caller does not supply a scope.\n\nI have a small compiled-dist patch and Fastify integration coverage for the metadata response and unauthenticated challenge. This is related to #179, which tracks our other 2.2.0 resource-server fixes.