[BUG] MCP HTTP OAuth flow ignores custom "scope" from .mcp.json, sends hardcoded defaults instead
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
## Description
When an HTTP MCP server is configured in .mcp.json with a custom oauth.scope, Claude Code ignores it and sends
hardcoded default scopes (openid profile email uaa.offline_token user_attributes) in the authorization request. This
causes the OAuth flow to fail when the identity provider rejects unknown scopes.
## .mcp.json configuration
```json
{
"mcpServers": {
"designreviewmcp": {
"type": "http",
"url": "http://localhost:6010/xxxxxxxx/v1/mcp/session",
"oauth": {
"clientId": "xxxxxxxxxxxxxxxxxx",
"scope": "scope1 scope2",
"authServerMetadataUrl": "https://tenant.server.com/.well-known/openid-configuration"
}
}
}
}
### What Should Happen?
The authorization request should use the scopes from .mcp.json:
scope=scope1 scope2
### Error Messages/Logs
```shell
The authorization request uses hardcoded default scopes:
scope=openid+profile+email+uaa.offline_token+user_attributes
The identity providerrejects user_attributes as invalid:
error=invalid_scope&error_description=user_attributes is invalid.
Please use a valid scope name in the request
PS: My corporate identity server does not support user_attributes scopeSteps to Reproduce
- Configure an HTTP MCP server in .mcp.json with a custom oauth.scope (as above)
- Start Claude Code — /doctor reports the server needs authentication
- Initiate the OAuth flow (via /mcp or the authenticate tool)
- Observe the authorization URL that Claude Code generates
Claude Model
Opus
Is this a regression?
No, this never worked
Last Working Version
_No response_
Claude Code Version
2.1.220
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
PowerShell
Additional Information
Error url shown in the browser: ?error=invalid_scope&error_description=user_attributes%20is%20invalid.%20Please%20use%20a%20valid%20scope%20name%20in%20the%20request&state=ukiZFySkdkdGEW65zBJTtmU55o6l6bLKtFJIZ0Pnodc
Root cause hypothesis
This appears related to #66456 (https://github.com/anthropics/claude-code/issues/66456) — the OAuth initiation path
reads from an internal cache rather than from the .mcp.json config. On first connection the cache is empty, so custom
fields like scope are undefined and fall back to hardcoded defaults.
3 Comments
Hi. Any updates on this issue? Thank you.
This is a config key mismatch rather than hardcoded scopes: the supported field is
oauth.scopes(plural) — see https://code.claude.com/docs/en/mcp#restrict-oauth-scopes.oauth.scopeis not a recognized key, so it has no effect, and as that section explains, whenauthServerMetadataUrlis configured thescopes_supportedlist from that metadata document is what gets requested.openid profile email uaa.offline_token user_attributesis the list your identity server advertises there, not a Claude Code default.Verified on 2.1.235 (Linux) with your config shape against a local test server: with
"scope": "scope1 scope2"the generated authorization URL carriesscope=openid+profile+email+uaa.offline_token+user_attributes(the metadata'sscopes_supported); renaming the key to"scopes": "scope1 scope2"producesscope=scope1+scope2.🤖 Generated with Claude Code
---
_Generated by Claude Code_
There is still a bug. Here is Claude Code's findings based on the logs from Claude Code's debug folder:
In the logs, first i see:
Overrode authorization scope from openid profile email xf:nxxpreprod:nxxeng:Viewer dcmcpreview.mcpreview to configured: xf:nxxpreprod:nxxeng:Viewer dcmcpreview.mcpreviewThen later just before exchanging the code for a token I see this log line:
Using scope from metadata: openid profile email uaa.offline_token user_attributesHere are the raw logs from debug folder (scrubbed to remove the server details):
Please reopen the issue. Thank you.