--- title: MCP Scope Step-Up Authorization: From Implementation to... description: WunderGraph implemented per-tool OAuth scope step-up authorization in their Cosmo MCP server, where each MCP tool requires only the specific OAuth scopes it... canonical: https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MCP Scope Step-Up Authorization: From Implementation to Spec Contribution | daily.dev og:description: WunderGraph implemented per-tool OAuth scope step-up authorization in their Cosmo MCP server, where each MCP tool requires only the specific OAuth scopes it... og:url: https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a og:image: https://api.daily.dev/og/posts/jP90lnk4A.png og:image:alt: MCP Scope Step-Up Authorization: From Implementation to Spec Contribution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MCP Scope Step-Up Authorization: From Implementation to Spec Contribution **[WunderGraph](https://daily.dev/sources/wundergraph)** · 9 min read · 0 upvotes · 0 comments ## Summary WunderGraph implemented per-tool OAuth scope step-up authorization in their Cosmo MCP server, where each MCP tool requires only the specific OAuth scopes it needs rather than a broad token. During implementation they discovered an infinite authorization loop caused by the MCP TypeScript SDK overwriting scopes on each 403 challenge instead of accumulating them. The root cause is a gap between the MCP spec's Server Scope Management guidance (which asks servers to include previously granted scopes) and RFC 6750 (which says servers should only describe what the current operation needs). They argue scope accumulation is a client-side responsibility, filed issues against the TypeScript SDK and the MCP spec itself, and proposed three clarifications: servers should return only operation-required scopes in 403 challenges, clients should union existing and challenge scopes before re-authorizing, and 'authoritative' should mean authoritative for the current request only. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Per-Tool OAuth Scopes for MCP, Derived from Your Schema](https://daily.dev/posts/per-tool-oauth-scopes-for-mcp-derived-from-your-schema-y05pmgghg) · WunderGraph · 0 upvotes · 0 comments --- Tags: [#graphql](https://daily.dev/tags/graphql), [#authorization](https://daily.dev/tags/authorization), [#oauth](https://daily.dev/tags/oauth), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MCP Scope Step-Up Authorization: From Implementation to Spec Contribution","url":"https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a"},"datePublished":"2026-03-05T19:34:03.412Z","dateModified":"2026-03-05T19:34:30.003Z","description":"WunderGraph implemented per-tool OAuth scope step-up authorization in their Cosmo MCP server, where each MCP tool requires only the specific OAuth scopes it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9baa8a65421ed6de2825297616ab111d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9baa8a65421ed6de2825297616ab111d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"WunderGraph","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"WunderGraph","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1681654408/logos/WunderGraphs","url":"https://daily.dev/sources/wundergraph"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"graphql,authorization,oauth,mcp","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"WunderGraph","item":"https://daily.dev/sources/wundergraph"},{"@type":"ListItem","position":3,"name":"MCP Scope Step-Up Authorization: From Implementation to Spec Contribution"}]} ```