Skip to content

feat(server): add SEP-2350 scope challenge scenario - #481

Open
SamMorrowDrums wants to merge 4 commits into
modelcontextprotocol:mainfrom
SamMorrowDrums:sammorrowdrums-sep-2350-scope-step-up
Open

feat(server): add SEP-2350 scope challenge scenario#481
SamMorrowDrums wants to merge 4 commits into
modelcontextprotocol:mainfrom
SamMorrowDrums:sammorrowdrums-sep-2350-scope-step-up

Conversation

@SamMorrowDrums

@SamMorrowDrums SamMorrowDrums commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • add a language-neutral server conformance scenario for request-time OAuth insufficient_scope challenges
  • exercise tools/call, static and templated resources/read, and prompts/get with a fixed cross-SDK fixture contract
  • assert HTTP 403, ****** parameters, the complete required scope set in one challenge, and successful upgraded-token retries
  • restore sep-2350-server-single-challenge traceability and document the portable SUT contract
  • make normative server-side SHOULD warnings gate targeted conformance runs consistently while leaving optional/inconclusive diagnostics informational

The scenario uses existing primitive fixtures and opaque test tokens, so the negative result is observable wire behavior rather than a missing TypeScript API or test-only primitive. The core scenario does not import or depend on the TypeScript SDK.

A/B proof

Both legs used this conformance branch's official sdk ... --mode server --scenario sep-2350-server-scope-challenge --spec-version 2026-07-28 path.

TypeScript SDK ref Result
unmodified modelcontextprotocol/typescript-sdk@main (dcc01028) SUCCESS=5, WARNING=12, exit 1; four warnings each for HTTP 403, WWW-Authenticate, and sep-2350-server-single-challenge; all four full-token retries succeeded
SamMorrowDrums/typescript-sdk@scope-challenge-server-sdk (54e8deda) SUCCESS=17, no warnings or failures, exit 0

The feature fixture adapter is part of modelcontextprotocol/typescript-sdk#1624 and remains independent from this branch. The latest green run includes the maintainer-requested reuse of bearer-auth metadata configuration through verified AuthInfo.

Validation

  • npm test — 45 files, 541 tests passed
  • npm run lint
  • npm run typecheck
  • npm run build
  • targeted compliant and deliberately broken scope-challenge fixture tests
  • TypeScript SDK feature head 54e8deda — 17/17 official scenario checks passed

References

@SamMorrowDrums
feat(server): add SEP-2350 scope challenge scenario
ddd442c 
Exercise request-time insufficient_scope challenges across tools, static and templated resources, and prompts with a portable cross-SDK fixture contract. Make server WARNING checks gate conformance consistently.

Closes modelcontextprotocol#480

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@pkg-pr-new

pkg-pr-new Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npx https://pkg.pr.new/@modelcontextprotocol/conformance@481

commit: d98bdd8

@SamMorrowDrums SamMorrowDrums mentioned this pull request Aug 31, 2026
Merged
@SamMorrowDrums
fix(server): correct warning and scope challenge checks
ccb0744 
Keep SHOULD-level warnings blocking while making optional session and inconclusive lifecycle diagnostics informational. Accept valid advertised protected-resource metadata locations, preserve RFC 9728 path semantics, and enforce token grammar for bare auth parameters.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
panyam
panyam approved these changes Sep 3, 2026
View reviewed changes
Comment thread src/requirements.ts Resolved
Comment thread src/scenarios/server/scope-challenge.ts Resolved
@SamMorrowDrums
fix: separate diagnostics from warning failures
992406b 
Keep normative warnings blocking while reporting acceptable timing and fixture diagnostics as informational. Skip the SEP-2350 completeness verdict when no parseable Bearer challenge exists.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@pcarleton pcarleton mentioned this pull request Sep 6, 2026
Closed
@groupthinking groupthinking mentioned this pull request Sep 18, 2026
Closed
8 tasks
Copilot AI mentioned this pull request Sep 18, 2026
Merged
@panyam panyam mentioned this pull request Sep 23, 2026
Closed
@panyam

panyam commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Hey @SamMorrowDrums, I think this one has drifted into conflicts with main since early Sept.

Looks like just two files. src/scenarios/index.ts is the registry, where #330 and #396 both added entries.
src/scenarios/client/sse-retry.ts is the real one, #375 changed the retry timing gate in the same spot as the WARNING to INFO change here.

Also in case it helps get this reviewed, mcpkit (Go) still passes it 17/17 with no warnings at 992406b. So that's two SDKs green against it now that the TS side has merged.

I can push a rebased branch you can pull from if that's easier.

@SamMorrowDrums
chore: merge main and resolve scenario conflicts
d98bdd8 
Retain SEP-2350 scope challenges alongside main's skills scenarios. Preserve main's lower-bound-only SSE retry timing and test early, boundary, late, and missing timing observations.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@SamMorrowDrums

SamMorrowDrums commented Nov 10, 2026

Copy link
Copy Markdown
Author

Thanks @panyam for flagging the drift and for testing against mcpkit — much appreciated!

I've merged main and resolved the conflicts in src/scenarios/index.ts (kept both the SEP-2350 scope challenges and the SEP-2640 skills entries) and src/scenarios/client/sse-retry.ts (kept main's lower-bound-only timing rule, plus this PR's INFO for missing timing data, with updated tests). Build, typecheck, lint and the full test suite pass.

@pcarleton could you take another look when you get a chance?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@panyam panyam panyam approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add server conformance for SEP-2350 scope challenges

2 participants

@SamMorrowDrums @panyam