Repository navigation
Bug: validate_scope rejects client scopes when required scopes in None #2216
Description
Initial Checks
- I confirm that I'm using the latest version of MCP Python SDK
- I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue
Description
The validate_scope() function in the Python SDK incorrectly handles cases where there are no required scopes from the client. Instead of treating None as no restrictions, it interprets it as an empty list of allowed scopes. This causes scopes in the token to be rejected with InvalidScopeError, even if the client should be allowed to request them.
Example Code
Python & MCP Python SDK
1.26.0
Activity
shivama205 commentedon Mar 6, 2026
I'll take this. The bug is in
OAuthClientMetadata.validate_scope()— whenself.scopeisNone(no scopes registered), it converts to an empty list, rejecting all requested scopes. The fix is to treatNoneas "no restrictions" and allow any scope through.@nik1097 thanks for reporting, will have a PR up shortly.
fix: validate_scope treats None registered scopes as no restrictions
fix: validate_scope treats None registered scopes as no restrictions
fix: validate_scope should allow all scopes when no restriction
goingforstudying-ctrl commentedon Mar 8, 2026
Hi! I've submitted a fix for this issue in PR #2246.
The fix handles the case where client registration has scope=None by returning all requested scopes immediately, instead of treating None as an empty allowed list.
Let me know if any changes are needed!
fix: validate_scope should allow all scopes when no restriction
fix: handle None required_scopes in validate_scope as no restrictions
test: add validate_scope unit tests for None scope handling
shivama205 commentedon Mar 8, 2026
Hey! Just realized I forgot to link my PR here — #2224 has been up since March 6 with tests and passing CI. Apologies for not linking it sooner!
fix: validate_scope treats None registered scopes as no restrictions
fix: remove scope registration check from authorize handler
fix(auth): allow any scope when client has no scope restrictions
fix: validate_scope allows any scope when client has no registered sc…
fix: remove unused OAuthClientMetadata import in test_auth
fix: use model_validate to satisfy pyright AnyUrl type check
refactor: use set operations for scope validation per reviewer feedback
Fix validate_scope rejecting scopes when client scope is None
fix: validate_scope allows any scope when client has no registered sc…
fix: remove unused OAuthClientMetadata import in test_auth
fix: use model_validate to satisfy pyright AnyUrl type check
refactor: use set operations for scope validation per reviewer feedback
Fix validate_scope rejecting scopes when client scope is None
Christian-Sidak commentedon Apr 17, 2026
Opened a fix in #2461 -- returns requested scopes immediately when self.scope is None (no restrictions registered), with 7 test cases covering the edge cases.
saneGuy commentedon Jul 22, 2026
From the current issue state, I understand #2301 from @maxisbey is the current path: remove the registration-scope check entirely, aligned with the step-up flow. I also see it is currently conflicting with main after the recent auth changes.
I hit this in practice: an OAuth client registered without a scope field cannot authorize with requested scopes, and the step-up flow fails after the scope challenge.
Would it help if I picked up one of two paths? Entirely your call:
Happy to be assigned either path, or to leave it alone if it's already planned.
AI assistance used for drafting; reviewed and owned by me.