Discover MCP OAuth scopes from server metadata at connect (#1032)

* Discover MCP OAuth scopes from server metadata at connect MCP-style integrations declare no OAuth scopes of their own; the scopes live on the server. Replace the declared/client scope union with an integration-driven scope policy: resolveOAuthScopePolicy returns either the template's declared scopes or a { kind: "discover" } marker. For the discover case, oauth.start reads the request scopes from the client's RFC 9728 protected-resource metadata, falling back to the RFC 8414 authorization-server metadata it names. Harden the transparent-DCR connect flow: carry the probe result through the bring-your-own-app fallback, match registered apps against discovered endpoints (requireEndpointMatch), and seed the register form with discovered scopes and token-endpoint auth methods via a shared registrationScopes helper. Add a self-host e2e scenario covering MCP OAuth scope discovery. Entire-Checkpoint: dc839672b8b0 * Bound MCP OAuth scope discovery against hostile or slow servers discoverScopesForResource takes its input entirely from a remote MCP server (the protected-resource metadata and the authorization servers it names). Add three bounds, each guarding a distinct failure: cap the authorization-server probe list at 3 (outbound request fan-out to server-named hosts), cap the discovered scope count at 100 (authorize-URL length), and wrap the whole sequence in a 30s timeout (total wall-clock; larger than the per-request timeout so it bounds the sequence, not a single slow-but-valid request). Tests: a 200-scope advertisement capped to 100, a four-AS list where the 3-server cap stops before the fourth (its scope never appears), and client_credentials reaching the discover path with the discovered scopes recorded on the connection. Entire-Checkpoint: f23d8ac3c4e2 * e2e: prove MCP OAuth scope discovery against a deployed emulate server Add an emulate-backed counterpart to the in-process scope-discovery selfhost test. It points at the @executor-js/emulate GitHub MCP `scope-discovery` instance, whose protected-resource metadata is silent on scopes so oauth.start must fall back to the authorization-server metadata it names, and asserts the authorize URL carries exactly the discovered scopes. Keeps the hermetic in-process test; adds real-deployment fidelity. * Format MCP OAuth scope discovery e2e Entire-Checkpoint: d3ea2960c9ec * Never seed RFC 8707 resource indicator from token endpoint DCR's resource fallback used the probe discovery URL, which collapses to the token endpoint for integrations without a real discovery URL. The token endpoint is not a resource identifier, so a non-MCP DCR client could register the token URL as its RFC 8707 resource indicator and have oauth.start probe it as a protected resource. Thread the genuine discovery URL (the MCP server URL) as a distinct resourceFallback; when absent, the indicator stays null as before. MCP flows are unchanged. Adds a regression test for the non-MCP case. ---------

Gjermund Garaba committed 4 months ago

Commit 5ecb95f1 parent f13cdea17 files · +1116 −112Browse files

Unified · Split

17 files

e2e/selfhost/mcp-oauth-scope-discovery-emulate.test.ts +127 −0
e2e/selfhost/mcp-oauth-scope-discovery.test.ts +123 −0
packages/core/sdk/src/executor.ts +25 −17
packages/core/sdk/src/oauth-scope-union.test.ts +431 −19
packages/core/sdk/src/oauth-service.ts +129 −36
packages/core/sdk/src/testing.ts +1 −0
packages/core/sdk/src/testing/oauth-test-server.ts +7 −0
packages/plugins/mcp/src/react/auth-method-config.test.ts +9 −3
packages/plugins/mcp/src/sdk/plugin.test.ts +47 −0
packages/plugins/mcp/src/sdk/plugin.ts +4 −3
packages/react/src/components/add-account-modal.test.ts +50 −2
packages/react/src/components/add-account-modal.tsx +64 −24
packages/react/src/components/auth-template-editor.tsx +2 −2
packages/react/src/components/oauth-client-form.test.ts +28 −0
packages/react/src/components/oauth-client-form.tsx +39 −4
packages/react/src/plugins/use-effective-oauth-client.test.ts +13 −0
packages/react/src/plugins/use-effective-oauth-client.tsx +17 −2

e2e/selfhost/mcp-oauth-scope-discovery-emulate.test.ts+127−0

@@ -0,0 +1,127 @@
	1	// Selfhost-only, emulate-backed counterpart to mcp-oauth-scope-discovery.test.ts.
	2	// Same claim — an MCP integration declares NO oauth scopes, so `oauth.start`
	3	// DISCOVERS them from the server's metadata at connect — but proven against a
	4	// REAL, deployed emulate MCP server instead of an in-process stub.
	5	//
	6	// The `@executor-js/emulate` GitHub MCP emulator exposes a `scope-discovery`
	7	// instance whose RFC 9728 protected-resource metadata is deliberately SILENT on
	8	// scopes, forcing a spec-faithful client to fall back to the RFC 8414
	9	// authorization-server metadata it names — which advertises the scopes below.
	10	// The selfhost dev server fetches that live metadata over the network and the
	11	// returned authorize URL carries exactly the discovered scopes.
	12	import { randomBytes } from "node:crypto";
	13
	14	import { expect } from "@effect/vitest";
	15	import { Effect } from "effect";
	16	import { composePluginApi } from "@executor-js/api/server";
	17	import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
	18	import {
	19	AuthTemplateSlug,
	20	ConnectionName,
	21	IntegrationSlug,
	22	OAuthClientSlug,
	23	} from "@executor-js/sdk/shared";
	24	import { scopesFromAuthorizeUrl } from "@executor-js/sdk/testing";
	25
	26	import { scenario } from "../src/scenario";
	27	import { Api, Target } from "../src/services";
	28
	29	const api = composePluginApi([mcpHttpPlugin()] as const);
	30
	31	// The deployed emulate instance whose protected-resource metadata is silent on
	32	// scopes (it serves the MCP transport AND its own OAuth authorize/token + the
	33	// RFC 9728/8414 metadata). The `scope-discovery` preset configures it; no seed
	34	// call is needed. Use the path form — a two-label instance subdomain has no
	35	// Universal SSL cert.
	36	const EMULATOR_BASE = "https://emulators.dev/github/scope-discovery";
	37	const MCP_ENDPOINT = `${EMULATOR_BASE}/mcp`;
	38
	39	// The scopes the emulate server advertises, only in its authorization-server
	40	// metadata (the protected-resource metadata stays silent). Discovering them
	41	// proves executor followed the RFC 8414 fallback, not a declared set.
	42	const DISCOVERED_SCOPES = ["channels:history", "users:read"] as const;
	43
	44	const freshSlug = (prefix: string): string => `${prefix}-${randomBytes(4).toString("hex")}`;
	45
	46	scenario(
	47	"MCP OAuth · oauth.start discovers scopes from a deployed emulate MCP server",
	48	{},
	49	Effect.scoped(
	50	Effect.gen(function* () {
	51	const target = yield* Target;
	52	const { client: makeApiClient } = yield* Api;
	53
	54	const identity = yield* target.newIdentity();
	55	const client = yield* makeApiClient(api, identity);
	56	const slug = freshSlug("mcp-scope-emulate");
	57
	58	// An MCP integration pointed at the deployed emulate server — no scopes
	59	// declared on the integration; the server is the source.
	60	yield* client.mcp.addServer({
	61	payload: {
	62	transport: "remote",
	63	name: "Scope-discovery MCP (emulate)",
	64	endpoint: MCP_ENDPOINT,
	65	slug,
	66	authenticationTemplate: [{ kind: "oauth2" }],
	67	},
	68	});
	69	yield* Effect.addFinalizer(() =>
	70	client.mcp
	71	.removeServer({ params: { slug: IntegrationSlug.make(slug) } })
	72	.pipe(Effect.ignore),
	73	);
	74
	75	// An OAuth app bound to the emulate MCP server as its resource (RFC 8707),
	76	// using the emulate instance's own authorize/token endpoints. The app
	77	// carries no scope set of its own.
	78	const clientSlug = OAuthClientSlug.make(freshSlug("mcp-scope-emulate-app"));
	79	yield* client.oauth.createClient({
	80	payload: {
	81	owner: "org",
	82	slug: clientSlug,
	83	authorizationUrl: `${EMULATOR_BASE}/authorize`,
	84	tokenUrl: `${EMULATOR_BASE}/token`,
	85	grant: "authorization_code",
	86	clientId: "test-client",
	87	clientSecret: "test-secret",
	88	resource: MCP_ENDPOINT,
	89	},
	90	});
	91	// `removeServer` only reaps DCR-shaped clients, so this manually-created
	92	// app must be removed explicitly.
	93	yield* Effect.addFinalizer(() =>
	94	client.oauth
	95	.removeClient({ params: { slug: clientSlug }, payload: { owner: "org" } })
	96	.pipe(Effect.ignore),
	97	);
	98
	99	const started = yield* client.oauth.start({
	100	payload: {
	101	owner: "org",
	102	client: clientSlug,
	103	clientOwner: "org",
	104	name: ConnectionName.make("main"),
	105	integration: IntegrationSlug.make(slug),
	106	template: AuthTemplateSlug.make("oauth2"),
	107	},
	108	});
	109
	110	expect(started.status, "start hands back an authorize redirect").toBe("redirect");
	111	if (started.status !== "redirect") return;
	112	// The redirect opened an in-flight OAuth session; drop it so the run leaves
	113	// no pending session behind.
	114	yield* Effect.addFinalizer(() =>
	115	client.oauth.cancel({ payload: { state: started.state } }).pipe(Effect.ignore),
	116	);
	117
	118	// The selfhost server fetched the deployed emulate server's metadata —
	119	// silent protected resource, then its authorization server — and requested
	120	// exactly the scopes it advertised.
	121	expect(
	122	scopesFromAuthorizeUrl(started.authorizationUrl),
	123	"the authorize URL carries exactly the scopes the deployed emulate MCP server advertises",
	124	).toEqual([...DISCOVERED_SCOPES]);
	125	}),
	126	),
	127	);

e2e/selfhost/mcp-oauth-scope-discovery.test.ts+123−0

@@ -0,0 +1,123 @@
	1	// Selfhost-only: an MCP integration declares NO oauth scopes — the server does.
	2	// At connect, `oauth.start` DISCOVERS the request scopes from the MCP server's
	3	// RFC 9728 protected-resource metadata and asks for exactly those on the
	4	// authorize URL. Proven end-to-end: a real MCP server (in this process)
	5	// publishes `scopes_supported`; the selfhost dev server fetches it over loopback
	6	// and the returned authorize URL carries the discovered scopes — not a declared
	7	// set and not the OAuth app's own scopes (the app declares none).
	8	import { randomBytes } from "node:crypto";
	9
	10	import { expect } from "@effect/vitest";
	11	import { Effect } from "effect";
	12	import { composePluginApi } from "@executor-js/api/server";
	13	import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
	14	import { makeGreetingMcpServer, serveMcpServer } from "@executor-js/plugin-mcp/testing";
	15	import {
	16	AuthTemplateSlug,
	17	ConnectionName,
	18	IntegrationSlug,
	19	OAuthClientSlug,
	20	} from "@executor-js/sdk/shared";
	21	import { scopesFromAuthorizeUrl, serveOAuthTestServer } from "@executor-js/sdk/testing";
	22
	23	import { scenario } from "../src/scenario";
	24	import { Api, Target } from "../src/services";
	25
	26	const api = composePluginApi([mcpHttpPlugin()] as const);
	27
	28	// The scopes the MCP server advertises in its protected-resource metadata.
	29	const DISCOVERED_SCOPES = ["channels:history", "users:read"] as const;
	30
	31	const freshSlug = (prefix: string): string => `${prefix}-${randomBytes(4).toString("hex")}`;
	32
	33	scenario(
	34	"MCP OAuth · oauth.start requests the scopes the server advertises, not a declared set",
	35	{},
	36	Effect.scoped(
	37	Effect.gen(function* () {
	38	const target = yield* Target;
	39	const { client: makeApiClient } = yield* Api;
	40
	41	// A real authorization server (endpoints for the OAuth app) and a real MCP
	42	// server whose RFC 9728 metadata advertises `scopes_supported`. The MCP
	43	// integration declares NO template scopes — the server is the source.
	44	const oauth = yield* serveOAuthTestServer();
	45	const mcp = yield* serveMcpServer(() => makeGreetingMcpServer(), {
	46	auth: {
	47	validateAuthorization: () => Effect.succeed(true),
	48	authorizationServerUrls: [oauth.issuerUrl],
	49	scopes: [...DISCOVERED_SCOPES],
	50	},
	51	});
	52
	53	const identity = yield* target.newIdentity();
	54	const client = yield* makeApiClient(api, identity);
	55	const slug = freshSlug("mcp-scope-discovery");
	56
	57	// An MCP integration with a single OAuth method — no scopes declared.
	58	yield* client.mcp.addServer({
	59	payload: {
	60	transport: "remote",
	61	name: "Scope-discovery MCP",
	62	endpoint: mcp.endpoint,
	63	slug,
	64	authenticationTemplate: [{ kind: "oauth2" }],
	65	},
	66	});
	67	yield* Effect.addFinalizer(() =>
	68	client.mcp
	69	.removeServer({ params: { slug: IntegrationSlug.make(slug) } })
	70	.pipe(Effect.ignore),
	71	);
	72
	73	// An OAuth app bound to the MCP server as its resource (RFC 8707). The app
	74	// carries no scope set of its own.
	75	const clientSlug = OAuthClientSlug.make(freshSlug("mcp-scope-app"));
	76	yield* client.oauth.createClient({
	77	payload: {
	78	owner: "org",
	79	slug: clientSlug,
	80	authorizationUrl: oauth.authorizationEndpoint,
	81	tokenUrl: oauth.tokenEndpoint,
	82	grant: "authorization_code",
	83	clientId: "test-client",
	84	clientSecret: "test-secret",
	85	resource: mcp.endpoint,
	86	},
	87	});
	88	// Best-effort cleanup: `removeServer` only reaps DCR-shaped clients, so this
	89	// manually-created app must be removed explicitly.
	90	yield* Effect.addFinalizer(() =>
	91	client.oauth
	92	.removeClient({ params: { slug: clientSlug }, payload: { owner: "org" } })
	93	.pipe(Effect.ignore),
	94	);
	95
	96	const started = yield* client.oauth.start({
	97	payload: {
	98	owner: "org",
	99	client: clientSlug,
	100	clientOwner: "org",
	101	name: ConnectionName.make("main"),
	102	integration: IntegrationSlug.make(slug),
	103	template: AuthTemplateSlug.make("oauth2"),
	104	},
	105	});
	106
	107	expect(started.status, "start hands back an authorize redirect").toBe("redirect");
	108	if (started.status !== "redirect") return;
	109	// The redirect opened an in-flight OAuth session; drop it so the run leaves
	110	// no pending session behind.
	111	yield* Effect.addFinalizer(() =>
	112	client.oauth.cancel({ payload: { state: started.state } }).pipe(Effect.ignore),
	113	);
	114
	115	// The selfhost server fetched the MCP server's protected-resource metadata
	116	// and requested exactly the scopes it advertised.
	117	expect(
	118	scopesFromAuthorizeUrl(started.authorizationUrl),
	119	"the authorize URL carries exactly the scopes the MCP server advertised",
	120	).toEqual([...DISCOVERED_SCOPES]);
	121	}),
	122	),
	123	);

packages/core/sdk/src/executor.ts+25−17

@@ -85,7 +85,11 @@ import type { · 84 unmodified lines
85	IntegrationConfig,	85	IntegrationConfig,
86	RegisterIntegrationInput,	86	RegisterIntegrationInput,
87	} from "./integration";	87	} from "./integration";
88	import { makeOAuthService, type MintOAuthConnectionInput } from "./oauth-service";	88	import {
		89	makeOAuthService,
		90	type MintOAuthConnectionInput,
		91	type OAuthScopePolicy,
		92	} from "./oauth-service";
89	import type { OAuthService } from "./oauth-client";	93	import type { OAuthService } from "./oauth-client";
90	import {	94	import {
91	comparePolicyRow,	95	comparePolicyRow,
@@ -3192,23 +3196,27 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea · 3100 unmodified lines
3192	ownedKeys: (owner: Owner) => ownedKeys(owner),	3196	ownedKeys: (owner: Owner) => ownedKeys(owner),
3193	defaultWritableProvider,	3197	defaultWritableProvider,
3194	mintOAuthConnection: (input: MintOAuthConnectionInput) => mintOAuthConnection(input),	3198	mintOAuthConnection: (input: MintOAuthConnectionInput) => mintOAuthConnection(input),
3195	// Resolve the integration's DECLARED oauth scopes for a (integration,	3199	// One integration-row read + one projector run. Resolve the method this
3196	// template): load the row, run the owning plugin's auth-method projector,	3200	// template selects exactly as the runtime's `selectAuthMethod` does —
3197	// and return the matching oauth method's declared `oauth.scopes`. Drives	3201	// exact slug match, else the sole declared method (single-method
3198	// the union-with-client-scopes request in `oauth.start` so reusing a narrow	3202	// integrations accept any slug); an ambiguous miss selects nothing rather
3199	// client on a broad integration still requests the integration's full	3203	// than guessing across methods. The discover-vs-scopes choice then reads
3200	// scope set. Empty (no row / no oauth method / no declared scopes) ⇒ the	3204	// off that method (MCP exposes `discoveryUrl`), so core needs no plugin-id
3201	// union collapses to the client's scopes (current behavior).	3205	// knowledge.
3202	resolveDeclaredOAuthScopes: (integration: IntegrationSlug, template: AuthTemplateSlug) =>	3206	resolveOAuthScopePolicy: (integration: IntegrationSlug, template: AuthTemplateSlug) =>
3203	findIntegrationRow(integration).pipe(	3207	findIntegrationRow(integration).pipe(
3204	Effect.map((row): readonly string[] => {	3208	Effect.map((row): OAuthScopePolicy => {
3205	if (!row) return [];	3209	const methods = row ? describeAuthMethodsForRow(row) : [];
3206	const methods = describeAuthMethodsForRow(row);	3210	const selected =
3207	const match =	3211	methods.find((m: AuthMethodDescriptor) => m.template === String(template)) ??
3208	methods.find(	3212	(methods.length === 1 ? methods[0] : undefined);
3209	(m: AuthMethodDescriptor) => m.kind === "oauth" && m.template === String(template),	3213	const oauth = selected?.kind === "oauth" ? selected.oauth : undefined;
3210	) ?? methods.find((m: AuthMethodDescriptor) => m.kind === "oauth");	3214	// Declared scopes win. Discover only when the selected method
3211	return match?.oauth?.scopes ?? [];	3215	// declares none but names a source to discover them from (MCP).
		3216	if (oauth?.scopes === undefined && oauth?.discoveryUrl !== undefined) {
		3217	return { kind: "discover" };
		3218	}
		3219	return { kind: "scopes", scopes: oauth?.scopes ?? [] };
3212	}),	3220	}),
3213	),	3221	),
3214	httpClientLayer: config.httpClientLayer,	3222	httpClientLayer: config.httpClientLayer,

packages/core/sdk/src/oauth-scope-union.test.ts+431−19

@@ -1,6 +1,6 @@
1	import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";	1	import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
2	import { describe, expect, it } from "@effect/vitest";	2	import { describe, expect, it } from "@effect/vitest";
3	import { Context, Effect, Layer, Predicate, type Scope } from "effect";	3	import { Context, Effect, Exit, Layer, Predicate, type Scope } from "effect";
4	import { HttpServer, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";	4	import { HttpServer, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
5		5
6	import {	6	import {
@@ -13,12 +13,15 @@ import { · 6 unmodified lines
13	import type { AuthMethodDescriptor } from "./integration";	13	import type { AuthMethodDescriptor } from "./integration";
14	import { definePlugin, type IntegrationRecord } from "./plugin";	14	import { definePlugin, type IntegrationRecord } from "./plugin";
15	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";	15	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
16	import { serveOAuthTestServer } from "./testing/oauth-test-server";	16	import { serveTestHttpApp } from "./testing";
		17	import { scopesFromAuthorizeUrl, serveOAuthTestServer } from "./testing/oauth-test-server";
17		18
18	// Integration-driven scopes: at connect, `oauth.start` requests EXACTLY the	19	// Integration-driven scopes: at connect, `oauth.start` requests the integration's
19	// integration's DECLARED oauth scopes. The OAuth app carries no scope set of its	20	// scopes — its DECLARED oauth scopes when it has any, otherwise the scopes
20	// own, so there is no union and no over-request — the integration is the sole	21	// DISCOVERED from the server's RFC 9728 / RFC 8414 metadata (MCP-style). Either
21	// source of what to request. (Replaces the earlier declared∪client union model.)	22	// way the OAuth app carries no scope set of its own, so there is no union and no
		23	// over-request — the integration is the sole source of what to request. (Replaces
		24	// the earlier declared∪client union model.)
22		25
23	const INTEG = IntegrationSlug.make("acme");	26	const INTEG = IntegrationSlug.make("acme");
24	const TEMPLATE = AuthTemplateSlug.make("oauth");	27	const TEMPLATE = AuthTemplateSlug.make("oauth");
@@ -29,11 +32,15 @@ const DECLARED_SCOPES = ["calendar", "gmail", "drive", "sheets"] as const; · 4 unmodified lines
29		32
30	/** A plugin whose integration config carries declared oauth scopes, projected	33	/** A plugin whose integration config carries declared oauth scopes, projected
31	* into an oauth `AuthMethodDescriptor` via `describeAuthMethods` — exactly the	34	* into an oauth `AuthMethodDescriptor` via `describeAuthMethods` — exactly the
32	* shape `resolveDeclaredOAuthScopes` reads. `scopes: null` ⇒ no declared oauth	35	* shape `resolveOAuthScopePolicy` reads. `scopes: null` ⇒ no declared oauth
33	* scopes (the MCP/no-template-scopes case). */	36	* scopes (the MCP/no-template-scopes case). */
34	const makeScopePlugin = (config: { readonly scopes: readonly string[] \| null }) =>	37	const makeScopePluginWithId = <const TId extends string>(
		38	id: TId,
		39	config: { readonly scopes: readonly string[] \| null },
		40	options: { readonly discoversScopes?: boolean } = {},
		41	) =>
35	definePlugin(() => ({	42	definePlugin(() => ({
36	id: "acme" as const,	43	id,
37	storage: () => ({}),	44	storage: () => ({}),
38	resolveTools: () =>	45	resolveTools: () =>
39	Effect.succeed({	46	Effect.succeed({
@@ -44,9 +51,20 @@ const makeScopePlugin = (config: { readonly scopes: readonly string[] \| null }) · 4 unmodified lines
44	const cfg = record.config as { readonly scopes?: readonly string[] \| null } \| null;	51	const cfg = record.config as { readonly scopes?: readonly string[] \| null } \| null;
45	const scopes = cfg?.scopes;	52	const scopes = cfg?.scopes;
46	if (scopes == null) {	53	if (scopes == null) {
47	// No declared oauth scopes — the integration declares an oauth method	54	// No declared oauth scopes. Server-targeting methods (MCP) expose a
48	// with no template scopes (MCP/DCR-style). Declared scopes resolve to [].	55	// `discoveryUrl` and discover scopes from the server at connect; others
49	return [{ id: "oauth", label: "OAuth2", kind: "oauth", template: String(TEMPLATE) }];	56	// declare none. Declared scopes resolve to [].
		57	return [
		58	{
		59	id: "oauth",
		60	label: "OAuth2",
		61	kind: "oauth",
		62	template: String(TEMPLATE),
		63	...(options.discoversScopes
		64	? { oauth: { discoveryUrl: `https://${id}.example/mcp` } }
		65	: {}),
		66	},
		67	];
50	}	68	}
51	return [	69	return [
52	{	70	{
@@ -68,11 +86,97 @@ const makeScopePlugin = (config: { readonly scopes: readonly string[] \| null }) · 15 unmodified lines
68	}),	86	}),
69	}))();	87	}))();
70		88
71	/** Parse the `scope` query param from an authorize URL into an ordered list. */	89	const makeScopePlugin = (config: { readonly scopes: readonly string[] \| null }) =>
72	const scopesFromAuthorizeUrl = (authorizationUrl: string): readonly string[] => {	90	makeScopePluginWithId("acme", config);
73	const raw = new URL(authorizationUrl).searchParams.get("scope");	91
74	return raw == null \|\| raw.length === 0 ? [] : raw.split(" ");	92	const makeMcpScopePlugin = (config: { readonly scopes: readonly string[] \| null }) =>
75	};	93	makeScopePluginWithId("mcp", config, { discoversScopes: true });
		94
		95	/** Serve RFC 9728 protected-resource metadata and RFC 8414 authorization-server
		96	* metadata on one origin, with configurable scopes. `prm`: an object serves
		97	* protected-resource metadata (omit `scopesSupported` to leave the resource
		98	* SILENT on scopes; `[]` advertises an explicit empty set); `"error"` makes the
		99	* PRM endpoint return 500; `null`/absent makes it 404. `authServerScopes`, when
		100	* set, serves authorization-server metadata advertising those scopes. */
		101	const serveMetadataServer = (config: {
		102	readonly prm?:
		103	\| {
		104	readonly authorizationServers?: readonly string[];
		105	readonly scopesSupported?: readonly string[];
		106	}
		107	\| "error"
		108	\| null;
		109	readonly authServerScopes?: readonly string[];
		110	}) =>
		111	Effect.gen(function* () {
		112	const baseUrlRef = { value: "" };
		113	const respond = (path: string): HttpServerResponse.HttpServerResponse => {
		114	const base = baseUrlRef.value;
		115	if (path.startsWith("/.well-known/oauth-protected-resource")) {
		116	if (config.prm === "error")
		117	return HttpServerResponse.jsonUnsafe({ error: "boom" }, { status: 500 });
		118	if (config.prm == null) return HttpServerResponse.empty({ status: 404 });
		119	return HttpServerResponse.jsonUnsafe({
		120	resource: `${base}/mcp`,
		121	bearer_methods_supported: ["header"],
		122	...(config.prm.authorizationServers
		123	? { authorization_servers: config.prm.authorizationServers }
		124	: {}),
		125	...(config.prm.scopesSupported !== undefined
		126	? { scopes_supported: config.prm.scopesSupported }
		127	: {}),
		128	});
		129	}
		130	if (
		131	path === "/.well-known/oauth-authorization-server" &&
		132	config.authServerScopes !== undefined
		133	) {
		134	return HttpServerResponse.jsonUnsafe({
		135	issuer: base,
		136	authorization_endpoint: `${base}/authorize`,
		137	token_endpoint: `${base}/token`,
		138	response_types_supported: ["code"],
		139	code_challenge_methods_supported: ["S256"],
		140	scopes_supported: config.authServerScopes,
		141	});
		142	}
		143	return HttpServerResponse.empty({ status: 404 });
		144	};
		145	const server = yield* serveTestHttpApp((request) => Effect.succeed(respond(request.url)));
		146	baseUrlRef.value = server.baseUrl;
		147	return {
		148	baseUrl: server.baseUrl,
		149	authorizationEndpoint: server.url("/authorize"),
		150	tokenEndpoint: server.url("/token"),
		151	mcpResourceUrl: server.url("/mcp"),
		152	};
		153	});
		154
		155	/** Seed an MCP integration with no declared scopes and an OAuth app bound to the
		156	* given server as its resource, returning the executor ready to `oauth.start`.
		157	* The shared setup for the discovery cases below; case (h) inlines its own (no
		158	* `resource`) because the absent resource IS the case under test. */
		159	const setupMcpScopeClient = (server: {
		160	readonly authorizationEndpoint: string;
		161	readonly tokenEndpoint: string;
		162	readonly mcpResourceUrl: string;
		163	}) =>
		164	Effect.gen(function* () {
		165	const plugins = [memoryCredentialsPlugin(), makeMcpScopePlugin({ scopes: null })] as const;
		166	const { executor } = yield* makeTestWorkspaceHarness({ plugins });
		167	yield* executor.mcp.seed();
		168	yield* executor.oauth.createClient({
		169	owner: "org",
		170	slug: CLIENT,
		171	authorizationUrl: server.authorizationEndpoint,
		172	tokenUrl: server.tokenEndpoint,
		173	grant: "authorization_code",
		174	clientId: "test-client",
		175	clientSecret: "test-secret",
		176	resource: server.mcpResourceUrl,
		177	});
		178	return executor;
		179	});
76		180
77	describe("oauth.start integration-driven scopes", () => {	181	describe("oauth.start integration-driven scopes", () => {
78	it.effect(	182	it.effect(
@@ -151,10 +255,265 @@ describe("oauth.start integration-driven scopes", () => { · 72 unmodified lines
151	}),	255	}),
152	),	256	),
153	);	257	);
		258
		259	it.effect(
		260	"(c) for MCP with no protected-resource metadata, start requests no scopes (no arbitrary issuer probing)",
		261	() =>
		262	Effect.scoped(
		263	Effect.gen(function* () {
		264	// The server advertises authorization-server scopes but publishes no
		265	// RFC 9728 protected-resource metadata. We only follow the
		266	// authorization servers a resource NAMES, so with no PRM there is
		267	// nothing to follow — start requests no scopes rather than probing the
		268	// resource URL or its origin.
		269	const server = yield* serveMetadataServer({
		270	authServerScopes: ["channels:history", "users:read"],
		271	});
		272	const executor = yield* setupMcpScopeClient(server);
		273
		274	const started = yield* executor.oauth.start({
		275	owner: "org",
		276	client: CLIENT,
		277	clientOwner: "org",
		278	name: ConnectionName.make("main"),
		279	integration: INTEG,
		280	template: TEMPLATE,
		281	});
		282	expect(started.status).toBe("redirect");
		283	if (started.status !== "redirect") return;
		284
		285	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([]);
		286	}),
		287	),
		288	);
		289
		290	it.effect(
		291	"(d) for MCP, the resource's own scopes_supported wins over a divergent authorization server",
		292	() =>
		293	Effect.scoped(
		294	Effect.gen(function* () {
		295	// The resource publishes its own RFC 9728 `scopes_supported` AND names
		296	// an AS advertising a DIFFERENT set. The resource's list is
		297	// authoritative (RFC 9728 §7.2): start requests exactly it and never
		298	// consults the AS. This is the primary positive discovery path.
		299	const server = yield* serveMetadataServer({
		300	prm: { scopesSupported: ["channels:history", "users:read"] },
		301	authServerScopes: ["should:not:appear"],
		302	});
		303	const executor = yield* setupMcpScopeClient(server);
		304
		305	const started = yield* executor.oauth.start({
		306	owner: "org",
		307	client: CLIENT,
		308	clientOwner: "org",
		309	name: ConnectionName.make("main"),
		310	integration: INTEG,
		311	template: TEMPLATE,
		312	});
		313	expect(started.status).toBe("redirect");
		314	if (started.status !== "redirect") return;
		315
		316	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([
		317	"channels:history",
		318	"users:read",
		319	]);
		320	}),
		321	),
		322	);
		323
		324	it.effect(
		325	"(e) for MCP, discovers scopes from a cross-origin authorization server named in resource metadata",
		326	() =>
		327	Effect.scoped(
		328	Effect.gen(function* () {
		329	// The resource's PRM is silent on scopes but names an AS on a DIFFERENT
		330	// origin (RFC 9728). Discovery must follow `authorization_servers`, not
		331	// just the resource URL/origin.
		332	const authServer = yield* serveMetadataServer({
		333	authServerScopes: ["read:cross", "write:cross"],
		334	});
		335	const resourceServer = yield* serveMetadataServer({
		336	prm: { authorizationServers: [authServer.baseUrl] },
		337	});
		338	const executor = yield* setupMcpScopeClient(resourceServer);
		339
		340	const started = yield* executor.oauth.start({
		341	owner: "org",
		342	client: CLIENT,
		343	clientOwner: "org",
		344	name: ConnectionName.make("main"),
		345	integration: INTEG,
		346	template: TEMPLATE,
		347	});
		348	expect(started.status).toBe("redirect");
		349	if (started.status !== "redirect") return;
		350
		351	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([
		352	"read:cross",
		353	"write:cross",
		354	]);
		355	}),
		356	),
		357	);
		358
		359	it.effect(
		360	"(f) for MCP, an explicit empty resource scopes_supported is honored (no AS fallback)",
		361	() =>
		362	Effect.scoped(
		363	Effect.gen(function* () {
		364	// The resource explicitly advertises NO scopes; the AS would offer some,
		365	// but the resource's explicit empty set is authoritative.
		366	const server = yield* serveMetadataServer({
		367	prm: { scopesSupported: [] },
		368	authServerScopes: ["should:not:appear"],
		369	});
		370	const executor = yield* setupMcpScopeClient(server);
		371
		372	const started = yield* executor.oauth.start({
		373	owner: "org",
		374	client: CLIENT,
		375	clientOwner: "org",
		376	name: ConnectionName.make("main"),
		377	integration: INTEG,
		378	template: TEMPLATE,
		379	});
		380	expect(started.status).toBe("redirect");
		381	if (started.status !== "redirect") return;
		382
		383	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([]);
		384	}),
		385	),
		386	);
		387
		388	it.effect(
		389	"(g) for MCP, a resource-metadata discovery error fails start (no silent empty-scope fallback)",
		390	() =>
		391	Effect.scoped(
		392	Effect.gen(function* () {
		393	// A transient 500 on the PRM endpoint must surface, not be swallowed
		394	// into "request no scopes".
		395	const server = yield* serveMetadataServer({ prm: "error" });
		396	const executor = yield* setupMcpScopeClient(server);
		397
		398	const exit = yield* Effect.exit(
		399	executor.oauth.start({
		400	owner: "org",
		401	client: CLIENT,
		402	clientOwner: "org",
		403	name: ConnectionName.make("main"),
		404	integration: INTEG,
		405	template: TEMPLATE,
		406	}),
		407	);
		408	expect(Exit.isFailure(exit)).toBe(true);
		409	}),
		410	),
		411	);
		412
		413	it.effect(
		414	"(h) for MCP, a client with no resource fails start (discovery cannot run without one)",
		415	() =>
		416	Effect.scoped(
		417	Effect.gen(function* () {
		418	const server = yield* serveMetadataServer({ prm: { scopesSupported: ["read"] } });
		419	const plugins = [
		420	memoryCredentialsPlugin(),
		421	makeMcpScopePlugin({ scopes: null }),
		422	] as const;
		423	const { executor } = yield* makeTestWorkspaceHarness({ plugins });
		424	yield* executor.mcp.seed();
		425
		426	// No `resource` on the client — discovery has nothing to probe.
		427	yield* executor.oauth.createClient({
		428	owner: "org",
		429	slug: CLIENT,
		430	authorizationUrl: server.authorizationEndpoint,
		431	tokenUrl: server.tokenEndpoint,
		432	grant: "authorization_code",
		433	clientId: "test-client",
		434	clientSecret: "test-secret",
		435	});
		436
		437	const exit = yield* Effect.exit(
		438	executor.oauth.start({
		439	owner: "org",
		440	client: CLIENT,
		441	clientOwner: "org",
		442	name: ConnectionName.make("main"),
		443	integration: INTEG,
		444	template: TEMPLATE,
		445	}),
		446	);
		447	expect(Exit.isFailure(exit)).toBe(true);
		448	}),
		449	),
		450	);
		451
		452	it.effect("(j) caps server-advertised resource scopes so the authorize URL stays bounded", () =>
		453	Effect.scoped(
		454	Effect.gen(function* () {
		455	// A hostile/buggy server advertises far more scopes than any real
		456	// template. Discovery caps the request at 100 so the authorize URL
		457	// cannot be blown up.
		458	const manyScopes = Array.from({ length: 200 }, (_, i) => `scope:${i}`);
		459	const server = yield* serveMetadataServer({ prm: { scopesSupported: manyScopes } });
		460	const executor = yield* setupMcpScopeClient(server);
		461
		462	const started = yield* executor.oauth.start({
		463	owner: "org",
		464	client: CLIENT,
		465	clientOwner: "org",
		466	name: ConnectionName.make("main"),
		467	integration: INTEG,
		468	template: TEMPLATE,
		469	});
		470	expect(started.status).toBe("redirect");
		471	if (started.status !== "redirect") return;
		472
		473	const requested = scopesFromAuthorizeUrl(started.authorizationUrl);
		474	expect(requested.length).toBe(100);
		475	expect(requested).toEqual(manyScopes.slice(0, 100));
		476	}),
		477	),
		478	);
		479
		480	it.effect(
		481	"(k) caps the named authorization-server probe list at 3 (a 4th named AS is never reached)",
		482	() =>
		483	Effect.scoped(
		484	Effect.gen(function* () {
		485	// The resource's PRM is silent on scopes and names four authorization
		486	// servers. The first three contribute nothing; only the fourth would
		487	// advertise scopes. The 3-server cap stops before it, so discovery
		488	// yields no scopes — without the cap "capped:out" would appear.
		489	const as1 = yield* serveMetadataServer({});
		490	const as2 = yield* serveMetadataServer({});
		491	const as3 = yield* serveMetadataServer({});
		492	const as4 = yield* serveMetadataServer({ authServerScopes: ["capped:out"] });
		493	const resourceServer = yield* serveMetadataServer({
		494	prm: { authorizationServers: [as1.baseUrl, as2.baseUrl, as3.baseUrl, as4.baseUrl] },
		495	});
		496	const executor = yield* setupMcpScopeClient(resourceServer);
		497
		498	const started = yield* executor.oauth.start({
		499	owner: "org",
		500	client: CLIENT,
		501	clientOwner: "org",
		502	name: ConnectionName.make("main"),
		503	integration: INTEG,
		504	template: TEMPLATE,
		505	});
		506	expect(started.status).toBe("redirect");
		507	if (started.status !== "redirect") return;
		508
		509	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([]);
		510	}),
		511	),
		512	);
154	});	513	});
155		514
156	// -----------------------------------------------------------------------------	515	// -----------------------------------------------------------------------------
157	// (c) The recorded `oauth_scope` reflects the requested (declared) scopes when	516	// (i) The recorded `oauth_scope` reflects the requested (declared) scopes when
158	// the AS omits `scope`. A minimal inline token endpoint handles the	517	// the AS omits `scope`. A minimal inline token endpoint handles the
159	// client_credentials grant and deliberately OMITS `scope` from its response,	518	// client_credentials grant and deliberately OMITS `scope` from its response,
160	// forcing the recorded-scope fallback (`token.scope ?? requested.join(" ")`).	519	// forcing the recorded-scope fallback (`token.scope ?? requested.join(" ")`).
@@ -203,7 +562,7 @@ const serveScopelessTokenServer = (): Effect.Effect< · 42 unmodified lines
203		562
204	describe("oauth.start recorded scope fallback", () => {	563	describe("oauth.start recorded scope fallback", () => {
205	it.effect(	564	it.effect(
206	"(c) records the requested (declared) scopes when the authorization server omits scope",	565	"(i) records the requested (declared) scopes when the authorization server omits scope",
207	() =>	566	() =>
208	Effect.scoped(	567	Effect.scoped(
209	Effect.gen(function* () {	568	Effect.gen(function* () {
@@ -248,4 +607,57 @@ describe("oauth.start recorded scope fallback", () => { · 38 unmodified lines
248	}),	607	}),
249	),	608	),
250	);	609	);
		610
		611	it.effect(
		612	"(l) client_credentials discovers scopes and records them when the token endpoint omits scope",
		613	() =>
		614	Effect.scoped(
		615	Effect.gen(function* () {
		616	// Discover policy (MCP, no declared scopes) reached through the
		617	// client_credentials grant: scopes come from the resource's PRM, and
		618	// the scopeless token endpoint forces the recorded-scope fallback to
		619	// the discovered set.
		620	const metadataServer = yield* serveMetadataServer({
		621	prm: { scopesSupported: ["mcp:read", "mcp:write"] },
		622	});
		623	const tokenServer = yield* serveScopelessTokenServer();
		624	const plugins = [
		625	memoryCredentialsPlugin(),
		626	makeMcpScopePlugin({ scopes: null }),
		627	] as const;
		628	const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });
		629	yield* executor.mcp.seed();
		630
		631	yield* executor.oauth.createClient({
		632	owner: "org",
		633	slug: CLIENT,
		634	authorizationUrl: "http://127.0.0.1/authorize",
		635	tokenUrl: tokenServer.tokenEndpoint,
		636	grant: "client_credentials",
		637	clientId: "test-client",
		638	clientSecret: "test-secret",
		639	resource: metadataServer.mcpResourceUrl,
		640	});
		641
		642	const started = yield* executor.oauth.start({
		643	owner: "org",
		644	client: CLIENT,
		645	clientOwner: "org",
		646	name: ConnectionName.make("cc"),
		647	integration: INTEG,
		648	template: TEMPLATE,
		649	});
		650	expect(started.status).toBe("connected");
		651
		652	// The discovered scopes are requested and (the token endpoint omitting
		653	// `scope`) recorded on the connection.
		654	const row = yield* Effect.promise(() =>
		655	config.db.findFirst("connection", {
		656	where: (b) => b("name", "=", "cc"),
		657	}),
		658	);
		659	expect(row?.oauth_scope).toBe("mcp:read mcp:write");
		660	}),
		661	),
		662	);
251	});	663	});

packages/core/sdk/src/oauth-service.ts+129−36

 // redeems the session, exchanges the code, and mints the connection.
 // ---------------------------------------------------------------------------
-import { Effect, Layer, Option, Schema } from "effect";
+import { Duration, Effect, Layer, Option, Schema } from "effect";
 import { FetchHttpClient, type HttpClient } from "effect/unstable/http";
 import type { Connection } from "./connection";
 import {
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
+  OAuthDiscoveryError,
   registerDynamicClient as registerDynamicClientDcr,
 } from "./oauth-discovery";
 import {
   readonly oauthTokenUrl?: string | null;
 }
+/** The OAuth scope policy for a `(integration, template)`. Either the
+ *  integration declares the scopes to request (`scopes`, possibly empty — an
+ *  empty set requests no scopes), or it declares none and the request scopes
+ *  are discovered from the server's metadata at connect (`discover`, used by
+ *  MCP). The two are mutually exclusive by construction. */
+export type OAuthScopePolicy =
+  | { readonly kind: "scopes"; readonly scopes: readonly string[] }
+  | { readonly kind: "discover" };
 /** Everything the OAuth service needs from the executor: fuma access for the
  *  owned `oauth_client` / `oauth_session` tables, the default credential
  *  provider for minted tokens, a `mintOAuthConnection` callback (writes the
     input: MintOAuthConnectionInput,
   ) => Effect.Effect<Connection, StorageFailure>;
   /**
-   * Resolve the integration's DECLARED OAuth scopes for a given
+   * Resolve the OAuth scope policy for a `(integration, template)`:
-   * `(integration, template)` — the scopes the integration's auth template
+   *  - `{ kind: "scopes", scopes }`: the scopes the integration's auth template
-   * advertises (e.g. an OpenAPI bundle's full authentication-template scope
+   *    DECLARES (e.g. an OpenAPI bundle's authentication-template scope union),
-   * union), NOT the scopes frozen on a specific `oauth_client` row.
+   *    NOT the scopes frozen on a specific `oauth_client` row. These are
-   *
+   *    requested verbatim at connect (`start`); an empty set requests none.
-   * At connect (`start`) the requested scope set is the UNION of these declared
+   *  - `{ kind: "discover" }`: the integration declares no scopes, so `start`
-   * scopes and the client's configured scopes, so reusing a narrow client on a
+   *    discovers the request scopes from the server's RFC 9728 / RFC 8414
-   * broad integration still requests the integration's full scope set. When the
+   *    metadata. Used by server-targeting integrations (MCP) whose scopes live
-   * integration declares no OAuth scopes (MCP / DCR integrations discover scopes
+   *    on the server rather than in a template.
-   * from the server; integrations with no declared template scopes) this returns
-   * `[]` and the union collapses to the client's scopes — current behavior,
-   * unchanged.
    */
-  readonly resolveDeclaredOAuthScopes: (
+  readonly resolveOAuthScopePolicy: (
     integration: IntegrationSlug,
     template: AuthTemplateSlug,
-  ) => Effect.Effect<readonly string[], StorageFailure>;
+  ) => Effect.Effect<OAuthScopePolicy, StorageFailure>;
   readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
   readonly fetch?: typeof globalThis.fetch;
   readonly endpointUrlPolicy?: OAuthEndpointUrlPolicy;
   `oauth:${owner}:${integration}:${name}`;
 const refreshItemIdFor = (accessId: string): string => `${accessId}:refresh`;
-/** Order-preserving de-duplication of a scope list. The requested scope set is
+/** Order-preserving de-duplication of a scope list. */
- *  the integration's DECLARED scopes — the integration is the sole source of what
- *  to request; the OAuth app no longer carries a scope set. */
 const dedupeScopes = (scopes: readonly string[]): readonly string[] => [...new Set(scopes)];
 const recordedOAuthScope = (
   // callback; redirect-requiring flows fail loudly via `requireRedirectUri`.
   const redirectUri = deps.redirectUri;
+  // Caps on server-controlled discovery input — a hostile or buggy server must
+  // not be able to hang `oauth.start` or overflow the authorize URL.
+  const MAX_DISCOVERY_AUTH_SERVERS = 3; // AS-failover lists are tiny in practice
+  const MAX_DISCOVERED_SCOPES = 100; // far beyond any realistic authorization template
+  const capScopes = (scopes: readonly string[]): readonly string[] =>
+    dedupeScopes(scopes).slice(0, MAX_DISCOVERED_SCOPES);
+  // Discover the scopes to request when the integration declares none — only
+  // reached for integrations that opt in (MCP-style). The resource's own RFC
+  // 9728 `scopes_supported` is authoritative when present, even when empty (§2
+  // defines the field; §7.2 cautions against requesting more than it lists).
+  // Only when the resource is SILENT do we read the scopes advertised by the
+  // authorization servers it NAMES (RFC 8414) — we never probe arbitrary URLs.
+  const discoverScopesForResource = (
+    resource: string | null,
+  ): Effect.Effect<readonly string[], OAuthDiscoveryError> =>
+    Effect.gen(function* () {
+      if (resource == null) {
+        return yield* new OAuthDiscoveryError({
+          message: "Cannot discover OAuth scopes: the client has no resource configured",
+        });
+      }
+      // `httpClientLayer` flows through `options` so discovery uses the host's
+      // configured client (discovery self-provides from `options.httpClientLayer`).
+      const discoveryOptions = { endpointUrlPolicy: deps.endpointUrlPolicy, httpClientLayer };
+      const protectedResource = yield* discoverProtectedResourceMetadata(
+        resource,
+        discoveryOptions,
+      );
+      const resourceScopes = protectedResource?.metadata.scopes_supported;
+      if (resourceScopes !== undefined) return capScopes(resourceScopes);
+      // The resource is silent on scopes — read them from the authorization
+      // servers it names, in order. An advertised list is authoritative even
+      // when empty. Any AS we cannot read clean RFC 8414 metadata from —
+      // unreachable, 404, malformed, or issuer-mismatched — contributes nothing
+      // and we move on (mirroring the dynamic-registration discovery path); if
+      // none advertise scopes we request none and let the AS apply its defaults
+      // (RFC 8414 metadata is optional, so its absence is not a failure). The
+      // list is server-controlled, so cap how many of its hosts we probe.
+      for (const issuer of (protectedResource?.metadata.authorization_servers ?? []).slice(
+        0,
+        MAX_DISCOVERY_AUTH_SERVERS,
+      )) {
+        const authServer = yield* discoverAuthorizationServerMetadata(
+          issuer,
+          discoveryOptions,
+        ).pipe(Effect.catchTag("OAuthDiscoveryError", () => Effect.succeed(null)));
+        const scopes = authServer?.metadata.scopes_supported;
+        if (scopes !== undefined) return capScopes(scopes);
+      }
+      return [];
+    }).pipe(
+      // Bound the whole sequence (PRM + up to MAX_DISCOVERY_AUTH_SERVERS AS
+      // fetches, each with its own request timeout). 30s is larger than a single
+      // request timeout so it bounds the sequence, not a slow-but-valid request.
+      Effect.timeoutOrElse({
+        duration: Duration.seconds(30),
+        orElse: () =>
+          Effect.fail(
+            new OAuthDiscoveryError({
+              message: "OAuth scope discovery timed out",
+              cause: "timeout",
+            }),
+          ),
+      }),
+    );
   // -----------------------------------------------------------------------
   // createClient — write the oauth_client row.
   // -----------------------------------------------------------------------
         });
       }
-      // The INTEGRATION is the sole source of what to request — its declared auth
+      // Declared scopes win (driven by the selected auth template). MCP-style
-      // scopes (driven by the integration's tools, surfaced via the declared auth
+      // integrations declare none and discover them from the client's protected
-      // method). The OAuth app no longer carries a scope set, so there is no union
+      // resource / authorization server metadata at connect.
-      // to compute and no way to over-request from a stale client copy.
+      const scopePolicy = yield* deps
-      const declaredScopes = yield* deps
+        .resolveOAuthScopePolicy(input.integration, input.template)
-        .resolveDeclaredOAuthScopes(input.integration, input.template)
         .pipe(
           Effect.mapError(
             (cause) =>
               new OAuthStartError({
                 // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: StorageFailure carries a typed `message` field
-                message: `Failed to resolve declared OAuth scopes: ${cause.message}`,
+                message: `Failed to resolve OAuth scope policy: ${cause.message}`,
               }),
           ),
         );
-      const requestedScopes = dedupeScopes(declaredScopes);
+      const requestedScopes =
+        scopePolicy.kind === "discover"
+          ? yield* discoverScopesForResource(client.resource).pipe(
+              Effect.mapError(
+                (cause) =>
+                  new OAuthStartError({
+                    // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuthDiscoveryError carries a typed `message` field
+                    message: `Failed to discover OAuth scopes: ${cause.message}`,
+                  }),
+              ),
+            )
+          : dedupeScopes(scopePolicy.scopes);
       // client_credentials: exchange immediately and mint the connection.
       if (client.grant === "client_credentials") {
           redirect_url: flowRedirectUri,
           pkce_verifier: verifier,
           identity_label: input.identityLabel ?? null,
-          // Persist the requested scope set (declared ∪ client) so `complete`'s
+          // Persist the requested scope set (the integration's declared or
-          // recorded-scope fallback reflects exactly what was requested when the
+          // discovered scopes) so `complete`'s recorded-scope fallback reflects
-          // AS omits `scope`, without re-resolving the integration's declared
+          // exactly what was requested when the AS omits `scope`, without
-          // scopes at completion.
+          // re-resolving it at completion.
           payload: { owner: input.owner, clientOwner: input.clientOwner, requestedScopes },
           expires_at: expiresAt,
           created_at: now,
         pkceVerifier: sessionRow.pkce_verifier == null ? null : String(sessionRow.pkce_verifier),
         identityLabel: sessionRow.identity_label == null ? null : String(sessionRow.identity_label),
         expiresAt: Number(sessionRow.expires_at),
-        // The scope set `start` requested (declared ∪ client), persisted on the
+        // The scope set `start` requested (the integration's declared or
-        // session payload. Drives the recorded-scope fallback when the AS omits
+        // discovered scopes), persisted on the session payload. Drives the
-        // `scope`. Missing/legacy payloads fall back to the client's scopes below.
+        // recorded-scope fallback when the AS omits `scope`. Missing/legacy
+        // payloads fall back to the client's scopes below.
         requestedScopes: requestedScopesFromPayload(sessionRow.payload),
         // The app's owner, recorded by `start` — reload the SAME app at
         // completion by explicit owner (no derivation). Defaults to the session
     },
     client: LoadedOAuthClient,
     token: OAuth2TokenResponse,
-    /** The scope set requested at /authorize + /token (declared ∪ client) —
+    /** The scope set requested at /authorize + /token (the integration's
-     *  the recorded-scope fallback when the AS omits `scope`. */
+     *  declared or discovered scopes) — the recorded-scope fallback when the AS
+     *  omits `scope`. */
     requestedScopes: readonly string[],
     /** The owner of `client` — persisted so refresh loads it by explicit owner. */
     clientOwner: Owner,
         authorizationUrl: as.metadata.authorization_endpoint,
         tokenUrl: as.metadata.token_endpoint,
         resource: resource?.metadata.resource ?? null,
-        scopesSupported: as.metadata.scopes_supported,
+        // Prefer the resource's own RFC 9728 scopes (authoritative, even when
+        // empty); fall back to the authorization server's list only when PRM is
+        // silent. For a spec-compliant MCP server (one that publishes PRM) this
+        // matches what `oauth.start` discovers. The AS fallback is a best-effort
+        // hint for the registration form on servers that omit PRM — where
+        // `oauth.start` requests none — so the two can differ for those.
+        scopesSupported: resource?.metadata.scopes_supported ?? as.metadata.scopes_supported,
         registrationEndpoint: as.metadata.registration_endpoint ?? null,
         tokenEndpointAuthMethodsSupported: as.metadata.token_endpoint_auth_methods_supported,
       } satisfies OAuthProbeResult;

packages/core/sdk/src/testing.ts+1−0

@@ -23,6 +23,7 @@ export { · 22 unmodified lines
23	export {	23	export {
24	OAuthTestServer,	24	OAuthTestServer,
25	serveOAuthTestServer,	25	serveOAuthTestServer,
		26	scopesFromAuthorizeUrl,
26	OAuthTestServerAddressError,	27	OAuthTestServerAddressError,
27	OAuthTestServerFlowError,	28	OAuthTestServerFlowError,
28	type OAuthAuthorizationCompletion,	29	type OAuthAuthorizationCompletion,

packages/core/sdk/src/testing/oauth-test-server.ts+7−0

@@ -389,6 +389,13 @@ const completeAuthorizationCodeTokenFlow = · 388 unmodified lines
389	};	389	};
390	});	390	});
391		391
		392	/** Parse the `scope` query param from an authorize URL into an ordered list
		393	* (empty when the parameter is absent or blank). */
		394	export const scopesFromAuthorizeUrl = (authorizationUrl: string): readonly string[] => {
		395	const raw = new URL(authorizationUrl).searchParams.get("scope");
		396	return raw == null \|\| raw.length === 0 ? [] : raw.split(" ");
		397	};
		398
392	export const serveOAuthTestServer = (	399	export const serveOAuthTestServer = (
393	options: OAuthTestServerOptions = {},	400	options: OAuthTestServerOptions = {},
394	): Effect.Effect<OAuthTestServerShape, OAuthTestServerAddressError, Scope.Scope> =>	401	): Effect.Effect<OAuthTestServerShape, OAuthTestServerAddressError, Scope.Scope> =>

packages/plugins/mcp/src/react/auth-method-config.test.ts+9−3

     expect(mcpAuthMethodInputFromEditorValue({ kind: "none" })).toEqual({ kind: "none" });
   });
-  it("maps 'oauth' → { kind: 'oauth2' } (endpoints are resolved at connect time)", () => {
+  it("maps 'oauth' → { kind: 'oauth2' } (endpoints/scopes are resolved at connect time)", () => {
     const value: AuthTemplateEditorValue = {
       kind: "oauth",
       authorizationUrl: "https://a.example.com/auth",
     });
   });
-  it("maps oauth2 to an oauth editor value with no endpoints (discovered at connect)", () => {
+  it("maps oauth2 to an oauth editor value with no endpoints or scopes (discovered at connect)", () => {
-    expect(editorValueFromMcpAuthMethod({ slug: "oauth2", kind: "oauth2" })).toEqual({
+    expect(
+      editorValueFromMcpAuthMethod({
+        slug: "oauth2",
+        kind: "oauth2",
+      }),
+    ).toEqual({
       kind: "oauth",
       authorizationUrl: "",
       tokenUrl: "",
       { id: "none", kind: "none", source: "spec", template: "none" },
     ]);
     expect(methods[0]?.oauth?.discoveryUrl).toBe("https://mcp.example.com/mcp");
+    expect(methods[0]?.oauth?.scopes).toBeUndefined();
   });
   it("carries multi-placement methods through to the hub", () => {

packages/plugins/mcp/src/sdk/plugin.test.ts+47−0

@@ -18,6 +18,7 @@ import { · 17 unmodified lines
18	import {	18	import {
19	makeTestConfig,	19	makeTestConfig,
20	memoryCredentialsPlugin,	20	memoryCredentialsPlugin,
		21	scopesFromAuthorizeUrl,
21	serveOAuthTestServer,	22	serveOAuthTestServer,
22	serveTestHttpApp,	23	serveTestHttpApp,
23	} from "@executor-js/sdk/testing";	24	} from "@executor-js/sdk/testing";
@@ -502,6 +503,52 @@ describe("mcpPlugin", () => { · 478 unmodified lines
502	}),	503	}),
503	);	504	);
504		505
		506	it.effect("oauth.start discovers scopes for an MCP oauth method", () =>
		507	Effect.scoped(
		508	Effect.gen(function* () {
		509	const server = yield* serveOAuthTestServer({
		510	scopes: ["channels:history", "users:read"],
		511	});
		512	const executor = yield* createExecutor(
		513	makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),
		514	);
		515
		516	yield* executor.mcp.addServer({
		517	name: "Slack MCP",
		518	endpoint: server.mcpResourceUrl,
		519	slug: "slack_mcp",
		520	authenticationTemplate: [{ kind: "oauth2" }],
		521	});
		522	yield* executor.oauth.createClient({
		523	owner: "org",
		524	slug: OAuthClientSlug.make("slack-app"),
		525	authorizationUrl: server.authorizationEndpoint,
		526	tokenUrl: server.tokenEndpoint,
		527	grant: "authorization_code",
		528	clientId: "test-client",
		529	clientSecret: "test-secret",
		530	resource: server.mcpResourceUrl,
		531	});
		532
		533	const started = yield* executor.oauth.start({
		534	owner: "org",
		535	client: OAuthClientSlug.make("slack-app"),
		536	clientOwner: "org",
		537	name: ConnectionName.make("main"),
		538	integration: IntegrationSlug.make("slack_mcp"),
		539	template: AuthTemplateSlug.make("oauth2"),
		540	});
		541
		542	expect(started.status).toBe("redirect");
		543	if (started.status !== "redirect") return;
		544	expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([
		545	"channels:history",
		546	"users:read",
		547	]);
		548	}),
		549	),
		550	);
		551
505	// When discovery fails (auth, network, etc.) the connection still lands with	552	// When discovery fails (auth, network, etc.) the connection still lands with
506	// an empty tool set so the user can retry via `connections.refresh` once they	553	// an empty tool set so the user can retry via `connections.refresh` once they
507	// fix the underlying problem.	554	// fix the underlying problem.

packages/plugins/mcp/src/sdk/plugin.ts+4−3

 //   stdio                → []          (no remote connection to configure)
 //   apikey               → carried placements (headers / query params) verbatim
 //   oauth2               → an oauth method carrying the MCP endpoint to probe
-//                          (`discoveryUrl`); endpoints are discovered live at
+//                          (`discoveryUrl`). Endpoints/scopes are discovered
-//                          connect time, so they are NOT pre-resolved here. We
+//                          live at connect time, so they are NOT pre-resolved
-//                          mark `supportsDynamicRegistration: true` because MCP
+//                          here. We mark
+//                          `supportsDynamicRegistration: true` because MCP
 //                          OAuth servers are expected to support RFC 7591 DCR;
 //                          the connect flow probes to confirm and falls back.
 // ---------------------------------------------------------------------------

packages/react/src/components/add-account-modal.test.ts+50−2

@@ -278,6 +278,7 @@ describe("runDcrConnect", () => { · 277 unmodified lines
278	},	278	},
279	{	279	{
280	discoveryUrl: "https://mcp.example.com/mcp",	280	discoveryUrl: "https://mcp.example.com/mcp",
		281	resourceFallback: "https://mcp.example.com/mcp",
281	owner: "user",	282	owner: "user",
282	integrationName: "App",	283	integrationName: "App",
283	existingSlugs: [],	284	existingSlugs: [],
@@ -287,6 +288,42 @@ describe("runDcrConnect", () => { · 3 unmodified lines
287	);	288	);
288	expect(outcome.kind).toBe("started");	289	expect(outcome.kind).toBe("started");
289	expect(registerArgs!.scopes).toEqual(["declared.scope"]);	290	expect(registerArgs!.scopes).toEqual(["declared.scope"]);
		291	// PRM named no `resource`, so the genuine discovery URL (MCP) seeds the
		292	// RFC 8707 resource indicator.
		293	expect(registerArgs!.resource).toBe("https://mcp.example.com/mcp");
		294	});
		295
		296	it("never seeds the resource indicator from the token endpoint (non-MCP DCR)", async () => {
		297	// A DCR integration with no discovery URL: `discoveryUrl` falls back to the
		298	// token endpoint for probing, but the token endpoint is not an RFC 8707
		299	// resource identifier, so it must NOT become the resource. With no genuine
		300	// discovery URL and no PRM-named resource, the indicator stays null.
		301	let registerArgs: RegisterArgs \| null = null;
		302	const outcome = await runDcrConnect(
		303	{
		304	probe: (): Promise<ProbeResult \| null> =>
		305	Promise.resolve({
		306	authorizationUrl: "https://auth.example.com/authorize",
		307	tokenUrl: "https://auth.example.com/token",
		308	registrationEndpoint: "https://auth.example.com/register",
		309	}),
		310	register: (args: RegisterArgs): Promise<OAuthClientSlug \| null> => {
		311	registerArgs = args;
		312	return Promise.resolve(OAuthClientSlug.make("app"));
		313	},
		314	start: (): void => {},
		315	},
		316	{
		317	// discoveryUrl collapsed to the token endpoint (no real discovery URL).
		318	discoveryUrl: "https://auth.example.com/token",
		319	owner: "user",
		320	integrationName: "App",
		321	existingSlugs: [],
		322	integration: TEST_INTEGRATION,
		323	},
		324	);
		325	expect(outcome.kind).toBe("started");
		326	expect(registerArgs!.resource).toBeNull();
290	});	327	});
291		328
292	it("falls back to BYO when there is no registration endpoint (no register/start)", async () => {	329	it("falls back to BYO when there is no registration endpoint (no register/start)", async () => {
@@ -317,9 +354,13 @@ describe("runDcrConnect", () => { · 24 unmodified lines
317	integration: TEST_INTEGRATION,	354	integration: TEST_INTEGRATION,
318	},	355	},
319	);	356	);
320	expect(outcome).toEqual({	357	expect(outcome).toMatchObject({
321	kind: "fallback",	358	kind: "fallback",
322	reason: "no-registration-endpoint",	359	reason: "no-registration-endpoint",
		360	probe: {
		361	authorizationUrl: "https://auth.example.com/authorize",
		362	tokenUrl: "https://auth.example.com/token",
		363	},
323	});	364	});
324	expect(calls).toEqual(["probe"]);	365	expect(calls).toEqual(["probe"]);
325	});	366	});
@@ -378,7 +419,14 @@ describe("runDcrConnect", () => { · 52 unmodified lines
378	integration: TEST_INTEGRATION,	419	integration: TEST_INTEGRATION,
379	},	420	},
380	);	421	);
381	expect(outcome.kind).toBe("fallback");	422	expect(outcome).toMatchObject({
		423	kind: "fallback",
		424	reason: "registration-failed",
		425	probe: {
		426	authorizationUrl: "https://auth.example.com/authorize",
		427	tokenUrl: "https://auth.example.com/token",
		428	},
		429	});
382	expect(calls).toEqual(["register"]);	430	expect(calls).toEqual(["register"]);
383	});	431	});
384	});	432	});

packages/react/src/components/add-account-modal.tsx+64−24

 } from "../plugins/use-effective-oauth-client";
 import { cn } from "../lib/utils";
 import { buildUsageMap, connectionsUsingClient } from "../lib/oauth-client-usage";
-import { OAuthClientForm, type OAuthClientFormPrefill } from "./oauth-client-form";
+import {
+  OAuthClientForm,
+  registrationScopes,
+  type OAuthClientFormPrefill,
+} from "./oauth-client-form";
 import { RemoveOAuthAppDialog } from "./remove-oauth-app-dialog";
 import { AddCustomMethodForm, type CreateCustomMethod } from "./add-custom-method-modal";
 import { PlacementLine, type AuthMethod } from "../lib/auth-placements";
 /** Outcome of the DCR orchestration. `"started"` means the OAuth flow handed
  *  off (the popup/inline start ran); `"fallback"` means we could not auto-set-up
- *  (probe failed, or no registration endpoint) and the caller should fall back
+ *  — a failed probe, no registration endpoint, or a failed registration — and
- *  to the bring-your-own-app picker. */
+ *  the caller should fall back to the bring-your-own-app picker. A failed probe
+ *  carries no probe result; the other two reasons always carry the probe that
+ *  seeds the picker. */
 type DcrOutcome =
   | { readonly kind: "started" }
+  | { readonly kind: "fallback"; readonly reason: "probe-failed" }
   | {
       readonly kind: "fallback";
-      readonly reason: "probe-failed" | "no-registration-endpoint";
+      readonly reason: "no-registration-endpoint" | "registration-failed";
+      readonly probe: DcrProbeResult;
     };
 type RunDcrConnectDeps = {
 type RunDcrConnectInput = {
   readonly discoveryUrl: string;
+  /** The integration's genuine protected-resource URL (the MCP discovery URL),
+   *  used as the RFC 8707 resource indicator when the server's PRM names no
+   *  `resource`. Distinct from `discoveryUrl`, which falls back to the token
+   *  endpoint for probing: the token endpoint is NOT a resource identifier, so
+   *  it must never become the indicator. Undefined for integrations with no
+   *  discovery URL (non-MCP DCR), collapsing the resource to null as before. */
+  readonly resourceFallback?: string;
   readonly owner: Owner;
   readonly integrationName: string;
   /** The owner's existing client slugs, so the minted slug stays unique. */
  * Run the transparent DCR connect sequence: probe → register → start.
  *
  * - Probe failure → `{ kind: "fallback", reason: "probe-failed" }` (caller shows BYO).
- * - No registration endpoint → `{ kind: "fallback", reason: "no-registration-endpoint" }`.
+ * - No registration endpoint → `{ kind: "fallback", reason: "no-registration-endpoint", probe }`.
- * - Register failure → throws via the injected `register` rejecting; the caller
+ * - Registration failure → `{ kind: "fallback", reason: "registration-failed", probe }`.
- *   treats a thrown/rejected register as fallback (kept out of the happy path).
  * - Success → registers, calls `start`, returns `{ kind: "started" }`.
  */
 export async function runDcrConnect(
   const probe = await deps.probe(input.discoveryUrl);
   if (probe === null) return { kind: "fallback", reason: "probe-failed" };
   const registrationEndpoint = probe.registrationEndpoint;
-  if (!registrationEndpoint) return { kind: "fallback", reason: "no-registration-endpoint" };
+  if (!registrationEndpoint) return { kind: "fallback", reason: "no-registration-endpoint", probe };
   const slug = uniqueClientSlug(input.integrationName, input.existingSlugs);
-  const scopes =
+  const scopes = registrationScopes(input.declaredScopes ?? [], probe.scopesSupported ?? []);
-    input.declaredScopes && input.declaredScopes.length > 0
-      ? input.declaredScopes
-      : (probe.scopesSupported ?? []);
   const minted = await deps.register({
     owner: input.owner,
     slug,
     registrationEndpoint,
     authorizationUrl: probe.authorizationUrl,
     tokenUrl: probe.tokenUrl,
-    resource: probe.resource ?? null,
+    resource: probe.resource ?? input.resourceFallback ?? null,
     scopes,
     tokenEndpointAuthMethodsSupported: probe.tokenEndpointAuthMethodsSupported,
     clientName: dcrClientNameForIntegration(input.integrationName),
     redirectUri: input.redirectUri,
     originIntegration: input.integration,
   });
-  if (minted === null) return { kind: "fallback", reason: "probe-failed" };
+  if (minted === null) return { kind: "fallback", reason: "registration-failed", probe };
   deps.start({ client: minted, owner: input.owner });
   return { kind: "started" };
 }
   // the modal to the bring-your-own-app picker if auto setup is unavailable.
   const [dcrBusy, setDcrBusy] = useState(false);
   const [dcrFailed, setDcrFailed] = useState(false);
+  const [oauthFallbackProbe, setOAuthFallbackProbe] = useState<DcrProbeResult | null>(null);
   // FIX 3 escape hatch: when no registered app matched the integration's
   // endpoints, the unmatched apps are collapsed behind an opt-in expander.
   const [showOtherApps, setShowOtherApps] = useState(false);
     setCredentialOrigin("paste");
     setOnePasswordItemId("");
     setPickedApp(null);
+    setOAuthFallbackProbe(null);
     setDcrFailed(false);
   }, [initialState, allMethods, defaultOwner, ownerOptions]);
     endpointMatched: oauthEndpointMatched,
     displayRegisterCTA: oauthDisplayRegisterCTA,
   } = useOAuthClientsForIntegration({
-    tokenUrl: method?.oauth?.tokenUrl,
+    // MCP integrations declare no endpoints up front; once DCR has probed the
-    authorizationUrl: method?.oauth?.authorizationUrl,
+    // server we match registered apps against the DISCOVERED endpoints. With no
+    // endpoints to match (a server-targeting MCP integration), require an
+    // explicit match so we surface the register CTA instead of auto-selecting an
+    // unrelated provider's app.
+    tokenUrl: method?.oauth?.tokenUrl ?? oauthFallbackProbe?.tokenUrl,
+    authorizationUrl: method?.oauth?.authorizationUrl ?? oauthFallbackProbe?.authorizationUrl,
+    requireEndpointMatch: isDcr,
   });
   const oauthPopup = useOAuthPopupFlow({
     popupName: "add-account-oauth",
     setValues({});
     setCredentialOrigin("paste");
     setOnePasswordItemId("");
+    setDcrFailed(false);
+    setOAuthFallbackProbe(null);
   };
   // A just-created custom method joins the in-session list and is auto-selected
   };
   // Transparent DCR connect: probe → register → start, no app picker. On any
-  // failure (probe error or no registration endpoint) we flip `dcrFailed` so the
+  // failure (probe error, no registration endpoint, or registration failure) we
-  // bring-your-own-app picker renders as the recovery path with name/owner kept.
+  // flip `dcrFailed` so the bring-your-own-app picker renders as the recovery
+  // path with name/owner kept.
   const handleDcrConnect = async () => {
     const discoveryUrl = method?.oauth?.discoveryUrl ?? method?.oauth?.tokenUrl;
     if (!method || !discoveryUrl) {
       },
       {
         discoveryUrl,
+        // Only a genuine discovery URL (MCP) seeds the RFC 8707 resource
+        // indicator; the token-endpoint fallback baked into `discoveryUrl` must
+        // not, so pass the un-collapsed method value here.
+        resourceFallback: method.oauth?.discoveryUrl,
         owner: dcrOwner,
         integrationName,
         existingSlugs: [...oauthApps, ...oauthOtherApps].map((app: OAuthClientOption) =>
       ...(outcome.kind === "fallback" ? { dcr_fallback: true } : {}),
     });
     if (outcome.kind === "fallback") {
+      setOAuthFallbackProbe("probe" in outcome ? outcome.probe : null);
       setDcrFailed(true);
       toast.error("Automatic setup unavailable — register an app");
     }
                 )}
                 prefill={{
                   authorizationUrl:
-                    oauthHandoffPrefill?.authorizationUrl ?? method.oauth?.authorizationUrl,
+                    oauthHandoffPrefill?.authorizationUrl ??
-                  tokenUrl: oauthHandoffPrefill?.tokenUrl ?? method.oauth?.tokenUrl,
+                    method.oauth?.authorizationUrl ??
+                    oauthFallbackProbe?.authorizationUrl,
+                  tokenUrl:
+                    oauthHandoffPrefill?.tokenUrl ??
+                    method.oauth?.tokenUrl ??
+                    oauthFallbackProbe?.tokenUrl,
+                  resource:
+                    oauthHandoffPrefill?.resource ??
+                    oauthFallbackProbe?.resource ??
+                    method.oauth?.discoveryUrl ??
+                    null,
                   scopes: method.oauth?.scopes,
-                  registrationEndpoint: method.oauth?.registrationEndpoint,
+                  discoveredScopes: oauthFallbackProbe?.scopesSupported,
+                  registrationEndpoint:
+                    method.oauth?.registrationEndpoint ??
+                    oauthFallbackProbe?.registrationEndpoint ??
+                    undefined,
+                  tokenEndpointAuthMethodsSupported:
+                    oauthFallbackProbe?.tokenEndpointAuthMethodsSupported,
                   ...(oauthHandoffPrefill?.grant ? { grant: oauthHandoffPrefill.grant } : {}),
                   ...(oauthHandoffPrefill?.clientId
                     ? { clientId: oauthHandoffPrefill.clientId }
                     : {}),
-                  ...(oauthHandoffPrefill?.resource != null
-                    ? { resource: oauthHandoffPrefill.resource }
-                    : {}),
                 }}
                 fixedSlug={
                   oauthClientHandoff?.slug != null && oauthClientHandoff.slug.length > 0

packages/react/src/components/auth-template-editor.tsx+2−2

@@ -89,8 +89,8 @@ export interface AuthTemplateEditorProps { · 88 unmodified lines
89	* tabs. Clicking a pill applies its value as an editable default. */	89	* tabs. Clicking a pill applies its value as an editable default. */
90	readonly presets?: readonly AuthTemplateEditorPreset[];	90	readonly presets?: readonly AuthTemplateEditorPreset[];
91	/** Some integrations, notably MCP, discover OAuth metadata from the server at	91	/** Some integrations, notably MCP, discover OAuth metadata from the server at
92	* connection time. In that case the add form should declare OAuth but not	92	* connection time. In that case the add form should declare OAuth without
93	* expose editable provider URLs/scopes that are not persisted. */	93	* editable provider URLs or scopes. */
94	readonly oauthMetadata?: "editable" \| "discovered";	94	readonly oauthMetadata?: "editable" \| "discovered";
95	}	95	}
96		96

packages/react/src/components/oauth-client-form.test.ts+28−0

@@ -0,0 +1,28 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2
	3	import { registrationScopes } from "./oauth-client-form";
	4
	5	describe("registrationScopes", () => {
	6	it("sends declared scopes and ignores discovered when declared scopes exist", () => {
	7	// Declared (template) scopes are authoritative — a discovered set never wins.
	8	expect(registrationScopes(["a", "b"], ["x"])).toEqual(["a", "b"]);
	9	});
	10
	11	it("sends discovered scopes when none are declared", () => {
	12	expect(registrationScopes([], ["x", "y"])).toEqual(["x", "y"]);
	13	});
	14
	15	it("uses the current discovered set so a re-Discover replaces a prefilled probe", () => {
	16	// Probe of server A seeds the discovered state; a later Discover of server B
	17	// replaces it. With nothing declared, B's scopes register — not the stale A
	18	// set that arrived via the DCR fallback prefill.
	19	const seededFromProbeA = ["a:read"];
	20	const rediscoveredFromB = ["b:write"];
	21	expect(registrationScopes([], seededFromProbeA)).toEqual(["a:read"]);
	22	expect(registrationScopes([], rediscoveredFromB)).toEqual(["b:write"]);
	23	});
	24
	25	it("returns empty when nothing is declared or discovered", () => {
	26	expect(registrationScopes([], [])).toEqual([]);
	27	});
	28	});

packages/react/src/components/oauth-client-form.tsx+39−4

   readonly authorizationUrl?: string;
   readonly tokenUrl?: string;
   readonly resource?: string | null;
+  /** Template-DECLARED scopes (e.g. an OpenAPI bundle's scope union). Immutable
+   *  in the form and authoritative — always sent at registration, surviving
+   *  Discover. */
   readonly scopes?: readonly string[];
+  /** Scopes already DISCOVERED from a prior server probe (e.g. a DCR fallback).
+   *  Seed the form's discovered state; a later in-form Discover replaces them,
+   *  and they are only sent when no declared scopes exist. */
+  readonly discoveredScopes?: readonly string[];
   readonly grant?: OAuthGrant;
   /** Client id to seed (e.g. when editing an existing app). NOT a secret — the
    *  secret is never returned, so it is always re-entered. */
    *  method or surfaced by Discover), the form offers a one-click "Register
    *  automatically" path that needs no pasted client id/secret. */
   readonly registrationEndpoint?: string;
+  /** Token-endpoint auth methods the server advertises (RFC 8414), so a
+   *  prefilled "Register automatically" picks the right client-auth method
+   *  instead of defaulting to public ("none"). */
+  readonly tokenEndpointAuthMethodsSupported?: readonly string[];
 }
+/** The scopes to register via DCR. The integration's DECLARED (template) scopes
+ *  are authoritative and immutable, so they win. Otherwise the DISCOVERED set is
+ *  used — seeded from a prior server probe and replaced by any in-form Discover —
+ *  so re-discovering a different issuer can't register a stale set. */
+export const registrationScopes = (
+  declaredScopes: readonly string[],
+  discoveredScopes: readonly string[],
+): readonly string[] => (declaredScopes.length > 0 ? declaredScopes : discoveredScopes);
 export function OAuthClientForm(props: {
   /** Human label for the integration this app backs (used in toasts + default name). */
   readonly integrationName: string;
   const [authorizationUrl, setAuthorizationUrl] = useState(prefill?.authorizationUrl ?? "");
   const [tokenUrl, setTokenUrl] = useState(prefill?.tokenUrl ?? "");
   const [resource, setResource] = useState(prefill?.resource ?? null);
+  // Scopes to register with DCR. The form has no scopes input (DCR sends them
+  // verbatim). Declared scopes are the integration's TEMPLATE scopes — immutable
+  // and authoritative, so they survive Discover. Discovered scopes are seeded
+  // from a prior probe (e.g. a DCR fallback) and replaced by any in-form
+  // Discover; they are only sent when nothing is declared.
+  const declaredScopes = prefill?.scopes ?? [];
+  const [discoveredScopes, setDiscoveredScopes] = useState<readonly string[]>(
+    prefill?.discoveredScopes ?? [],
+  );
   const [discovering, setDiscovering] = useState(false);
   const [submitting, setSubmitting] = useState(false);
   // DCR (RFC 7591): the registration endpoint + advertised auth methods. Seeded
   const [registrationEndpoint, setRegistrationEndpoint] = useState(
     prefill?.registrationEndpoint ?? "",
   );
-  const [authMethods, setAuthMethods] = useState<readonly string[] | undefined>(undefined);
+  const [authMethods, setAuthMethods] = useState<readonly string[] | undefined>(
+    prefill?.tokenEndpointAuthMethodsSupported,
+  );
   const [registering, setRegistering] = useState(false);
   // Endpoints/scopes usually come prefilled from the integration's declared
     setAuthorizationUrl(result.authorizationUrl);
     setTokenUrl(result.tokenUrl);
     setResource(result.resource ?? null);
+    // Record the discovered scopes. Declared scopes (if any) still take
+    // precedence at registration, so a re-Discover reflects the latest server
+    // without clobbering a declared set.
+    setDiscoveredScopes(result.scopesSupported ?? []);
     // Capture DCR availability so the "Register automatically" path shows for a
     // pasted MCP/issuer URL without any client id/secret.
     setRegistrationEndpoint(result.registrationEndpoint ?? "");
         authorizationUrl: authorizationUrl.trim(),
         tokenUrl: tokenUrl.trim(),
         resource,
-        // DCR sends the integration's declared scopes to the AS at registration
+        // DCR sends the integration's declared scopes, or the discovered set when
-        // (the app itself stores none).
+        // none are declared, to the AS at registration (the app stores none).
-        scopes: [...(prefill?.scopes ?? [])],
+        scopes: [...registrationScopes(declaredScopes, discoveredScopes)],
         tokenEndpointAuthMethodsSupported: authMethods,
         clientName: name.trim(),
         redirectUri: oauthCallbackUrl(),

packages/react/src/plugins/use-effective-oauth-client.test.ts+13−0

@@ -96,6 +96,19 @@ describe("selectClientsForEndpoints", () => { · 95 unmodified lines
96	expect(result.unmatched).toEqual([]);	96	expect(result.unmatched).toEqual([]);
97	});	97	});
98		98
		99	it("with requireEndpointMatch and no endpoints, matches NOTHING (drives the register CTA)", () => {
		100	// A server-targeting integration (MCP, endpoints discovered at connect) must
		101	// not auto-select an unrelated provider's app just because nothing was
		102	// declared to filter on.
		103	const result = selectClientsForEndpoints([google, spotify], { requireEndpointMatch: true });
		104	expect(result.endpointMatched).toBe(false);
		105	expect(result.matched).toEqual([]);
		106	expect(result.unmatched.map((a: OAuthClientOption) => String(a.slug))).toEqual([
		107	"google-app",
		108	"spotify-app",
		109	]);
		110	});
		111
99	it("matches local-dev MCP by exact host when tldts cannot resolve a root domain", () => {	112	it("matches local-dev MCP by exact host when tldts cannot resolve a root domain", () => {
100	const local = app("local-mcp", {	113	const local = app("local-mcp", {
101	authorizationUrl: "http://localhost:8787/authorize",	114	authorizationUrl: "http://localhost:8787/authorize",

packages/react/src/plugins/use-effective-oauth-client.tsx+17−2

  */
 export function selectClientsForEndpoints(
   all: readonly OAuthClientOption[],
-  endpoints: { readonly tokenUrl?: string; readonly authorizationUrl?: string },
+  endpoints: {
+    readonly tokenUrl?: string;
+    readonly authorizationUrl?: string;
+    /** When set, an integration that targets a SPECIFIC server (MCP, whose
+     *  endpoints are discovered at connect) must match by endpoint — absent
+     *  endpoints mean NO match (show the register CTA), never "every app
+     *  matches". Prevents auto-selecting an unrelated provider's app. */
+    readonly requireEndpointMatch?: boolean;
+  },
 ): {
   readonly matched: readonly OAuthClientOption[];
   readonly unmatched: readonly OAuthClientOption[];
   const wantedAuthorizationRoot = endpoints.authorizationUrl
     ? getRootDomain(endpoints.authorizationUrl)
     : undefined;
-  // No declared endpoints → no filter; every app is usable.
+  // No declared endpoints. A server-targeting integration must NOT match every
+  // app (it would auto-select an unrelated provider); surface the register CTA
+  // instead. Otherwise (no endpoint filter at all) every app is usable.
   if (!wantedTokenRoot && !wantedAuthorizationRoot) {
+    if (endpoints.requireEndpointMatch) {
+      return { matched: [], unmatched: sortUserFirst(all), endpointMatched: false };
+    }
     return { matched: sortUserFirst(all), unmatched: [], endpointMatched: true };
   }
   const matched: OAuthClientOption[] = [];
 export function useOAuthClientsForIntegration(opts: {
   readonly tokenUrl?: string;
   readonly authorizationUrl?: string;
+  readonly requireEndpointMatch?: boolean;
 }): UseOAuthClientsResult {
   // Read the optimistic list so a just-registered/edited/removed app paints
   // immediately, instead of flashing the stale server list until the refetch
   const { matched, unmatched, endpointMatched } = selectClientsForEndpoints(all, {
     tokenUrl: opts.tokenUrl,
     authorizationUrl: opts.authorizationUrl,
+    requireEndpointMatch: opts.requireEndpointMatch,
   });
   // EXPLICIT outcome: when at least one app matched (or no endpoint was
   // declared) we present the matched subset. When an endpoint was declared but

Discover MCP OAuth scopes from server metadata at connect (#1032)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code