[xubenqiang]

Fixes #3778

AuthSettings.required_scopes is used both to refuse tokens (RequireAuthMiddleware) and as the Protected Resource Metadata's scopes_supported, so a server cannot advertise a scope that only some handlers check — a write scope, for example — without challenging for it on every request. Clients that take their scope request from scopes_supported then never ask for the write scope.

Change

• AuthSettings.scopes_supported: list[str] | None (new, optional): the scopes advertised in the Protected Resource Metadata.
• Both protected-resource route builders (mcpserver and lowlevel) use auth.scopes_supported or auth.required_scopes, so existing servers are unchanged and the challenge still uses required_scopes only.

Tests

tests/server/auth/test_protected_resource.py:

• test_scopes_supported_advertised_separately_from_required_scopes: an MCPServer with required_scopes=["returns:read"] and scopes_supported=["returns:read", "returns:write"] serves scopes_supported as both scopes over GET /.well-known/oauth-protected-resource/mcp.
• test_scopes_supported_defaults_to_required_scopes: without the new field, the metadata still advertises required_scopes.

Verified: pytest tests/server/auth/test_protected_resource.py -q -> 16 passed; with only the three source files reverted, the advertising test fails (the field is ignored and the metadata lists only returns:read). ruff check and ruff format --check are clean on all four files.

Note: the issue author offered to open this PR; this is unassigned work on the same proposal, and the tests above are new. Happy to adjust the field name or the default if you prefer a different shape.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[github-actions]

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3778.

If a maintainer assigns you to #3778, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

• We're a small team with very little capacity to review community PRs right now.
• Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.