MCPP-PRM07: PRM does not list scopes

Family	Protected Resource Metadata (RFC 9728)
Default severity	low
Confidence	high
Mode	passive (default scan)
Spec revisions	2025-06-18 and later

Why it matters

scopes_supported is RECOMMENDED; MCP clients fall back to it when the challenge carries no scope, to request least privilege.

Remediation

List the scopes the server understands in scopes_supported.

References

• RFC 9728 Protected Resource Metadata
• MCP 2025-11-25 Authorization

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-PRM07"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31