[FEATURE] Allow opting out of automatic offline_access for MCP OAuth clients

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Claude Code automatically appends offline_access when the authorization server advertises it, even when oauth.scopes explicitly excludes it.

Authorization-server metadata describes server-wide capabilities, not every registered client's permissions. A server may support refresh tokens while a particular pre-registered client permits only authorization_code and openid. Adding offline_access can therefore cause invalid_scope and prevent authentication.

Proposed Solution

Add a documented per-server opt-out from automatic offline_access. When enabled, Claude Code should:

• Request configured scopes without adding offline_access.
• Allow authorization-code authentication without a refresh token.
• Prompt for authentication again after access-token expiry when no refresh token is available.
• Preserve existing PKCE and other OAuth security checks.

Keep the existing behavior as the default for clients that have not opted out.

Alternative Solutions

Filtering authorization-server metadata requires extra infrastructure. Removing offline_access from global discovery hides capabilities used by other clients. Expanding a restricted client's permissions may conflict with its security policy.

Priority

Medium - Would be very helpful

Feature Category

MCP server integration

Use Case Example

An authorization server advertises:

{
  "scopes_supported": ["openid", "offline_access"]
}

A pre-registered public client permits only authorization_code and openid. Its Claude Code configuration includes:

{
  "oauth": {
    "scopes": "openid"
  }
}

With the opt-out enabled, the authorization request should contain scope=openid, not scope=openid+offline_access.

Additional Context

Current documentation.

Related: #41610. That issue concerns a server that does not advertise offline_access. This request concerns a server that advertises it, but a particular client is not permitted to request it.