[BUG] XAA token exchange and jwt-bearer requests do not include scope parameter

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When using claude with XAA enabled, MCP authentication does not use the scopes advertised by the authorization/resource server, configured in .claude.json or from the WWW-Authenticate challenge. This results in these issues:

• The ID-JAG from the token exchange includes no scope claim
• The JWT-bearer token request omits the scope parameter

What Should Happen?

The behavior should match MCP authentication without XAA and request the proper scopes.

Error Messages/Logs

Steps to Reproduce

Use XAA when adding an MCP server:

export CLAUDE_CODE_ENABLE_XAA=1
export MCP_XAA_IDP_CLIENT_SECRET=<client secret>
export MCP_CLIENT_SECRET=<mcp client secret>
claude mcp xaa setup --issuer <issuer> --client-id <client id> --client-secret
claude mcp xaa login
claude mcp add --xaa --client-id <mcp client id> --client-secret --transport http mcp <mcp url>

Start claude and run /mcp, then authenticate.

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.291

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_