feat: include granted scopes in OAuth refresh token request by DaleSeo · Pull Request #731 · modelcontextprotocol/rust-sdk

DaleSeo · 2026-03-07T16:31:42Z

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo · 2026-03-07T16:31:42Z

Fixes#624

Motivation and Context

RFC 6749 allows sending a scope parameter with refresh token requests, and some providers, especially Azure AD v2, actually require it. If you don't include it, the refresh might succeed quietly, but it will return a token without any scopes, or the server might reject the request altogether.

This fix keeps the full StoredCredentials, allowing us to add the previously granted scopes to the outgoing refresh request using .add_scope(). This follows the same pattern we already use in the authorization code and client credentials flows. If granted_scopes is empty, we won't send a scope parameter, which maintains the current behavior for providers that don't need it.

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 913 in 5c5a2e7

auth_request = auth_request.add_scope(Scope::new(scope.to_string()));

rust-sdk/crates/rmcp/src/transport/auth.rs

Line 1766 in 5c5a2e7

request = request.add_scope(Scope::new(scope.clone()));

How Has This Been Tested?

Added unit tests

Breaking Changes

None. Providers that don't accept a scope parameter on refresh requests will continue to work as before, since the parameter is only added when scopes were previously granted.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

alexhancock · 2026-03-09T19:55:52Z

+ );
+ }
+
+ async fn start_token_server() -> (String, Arc<std::sync::Mutex<Option<String>>>) {


we should #[cfg(test)] this yeah?

This is a private helper inside the #[cfg(test)] mod tests block, so it should be already gated.

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow # Conflicts: # crates/rmcp/src/transport/auth.rs # docs/OAUTH_SUPPORT.md

…textprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow

* pull in remote fixes for oauth * feat: include granted scopes in OAuth refresh token request (modelcontextprotocol#731) * fix: include granted scopes in OAuth refresh token request * docs: document scope forwarding in token refresh flow * clippy * Revert "clippy" This reverts commit 2cd946e. --------- Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>

DaleSeo added 2 commits March 7, 2026 11:23

fix: include granted scopes in OAuth refresh token request
2c9fbd6

docs: document scope forwarding in token refresh flow
ec5ef29

github-actionsBot added T-documentation Documentation improvements T-core Core library changes T-transport Transport layer changes labels Mar 7, 2026

DaleSeo changed the title ~~Fix/refresh token scopes~~fix: include granted scopes in OAuth refresh token requestMar 7, 2026

DaleSeo self-assigned this Mar 7, 2026

DaleSeo marked this pull request as ready for review March 7, 2026 16:38

DaleSeo requested a review from a team as a code owner March 7, 2026 16:38

DaleSeo changed the title ~~fix: include granted scopes in OAuth refresh token request~~feat: include granted scopes in OAuth refresh token requestMar 7, 2026

alexhancock approved these changes Mar 9, 2026
View reviewed changes

DaleSeo merged commit 54bb522 into mainMar 9, 2026
16 checks passed

DaleSeo deleted the fix/refresh-token-scopes branch March 9, 2026 20:30

github-actionsBot mentioned this pull request Mar 9, 2026
chore: release v1.2.0 #736
Merged

peicodes mentioned this pull request Mar 31, 2026
pull in remote fixes for oauth warpdotdev/rmcp#8
Closed

peicodes mentioned this pull request Mar 31, 2026
Fixes for oauth expiry and scopes warpdotdev/rmcp#9
Merged