invalid_scope on the MCP authorization request
When the 401 challenge carries no scope, VS Code — and Claude Code before 2.1.196 — fall back to requesting everything in scopes_supported. An authorization server with a large catalogue, or one that refuses combinations, answers invalid_scope — and the server operator sees nothing, because the request never reaches them.
npx mcpcomp doctor https://mcp.example.com/mcpdoctor classifies the failing layer — discovery, authorization server, endpoint liveness, or client auth state — from outside, with no credentials.
What the error means
The fallback is documented in both clients' sources (VS Code extHostMcp.ts:1108, mainThreadMcp.ts:242; Claude Code fixed a variant in 2.1.196). The request is well-formed; it simply asks for more than the identity provider will grant to that client. The authorization server rejects it before any token is minted.
How to diagnose it
Put the scope in the challenge
RFC 6750 lets the WWW-Authenticate challenge carry scope="...". Name the minimal scope the MCP server needs and clients will request that instead of the catalogue. MCPComp's scope-minimization check flags omnibus scope names (*, all, admin, full-access) in the PRM — a heuristic, and it says so.
Keep offline_access out of the PRM
Refresh-token behaviour belongs to the client, not to the resource's capability set (SEP-2207). MCPComp reports a PRM advertising offline_access as a low advisory.
Frequently asked questions
Why does the same server work in another client?
Clients that request a fixed scope, or that prompt the user, never hit the catalogue fallback. The server-side fix — a scope in the challenge — makes every client behave the same.