Delegate ScopeSelectorDelegate

Namespace

ModelContextProtocol.Authentication

Assembly

ModelContextProtocol.Core.dll

Represents a method that selects or filters the OAuth scopes to request during authorization.

public delegate IEnumerable<string>? ScopeSelectorDelegate(IReadOnlyCollection<string>? scope)

Parameters

scope IReadOnlyCollection<string>

The scopes determined by the MCP scope selection strategy (WWW-Authenticate header scope → scopes_supported from Protected Resource Metadata → Scopes fallback), with offline_access appended when advertised by the authorization server. May be null if the server provided no scope information and no fallback scopes are configured.

Returns

IEnumerable<string>

The scopes to include in the authorization and Dynamic Client Registration requests. Return null or an empty enumerable to omit the scope parameter entirely.

Remarks

Use this delegate to filter or customize the proposed scopes before the authorization request is made. Common scenarios include:

• Requesting only a subset of the scopes offered by the server.
• Appending a custom scope not advertised in the server metadata.

The MCP specification defines the following scope selection priority (highest to lowest): WWW-Authenticate header scope → PRM scopes_supported → omit scope parameter. The scope parameter already reflects this priority. The delegate runs after offline_access has been auto-appended, so it can also remove that scope if desired.

The resolved scope is applied consistently to both the authorization URL and the Dynamic Client Registration (DCR) request, so the registered client scope matches what is actually requested.