MCPP-SCP04: Resource scopes unknown to the authorization server

Family	Scopes
Default severity	info
Confidence	medium
Mode	passive (default scan)
Spec revisions	2025-06-18 and later

Why it matters

Scopes the resource advertises but the authorization server does not list will fail at authorization time, or are silently ignored, so clients end up with tokens that cannot call the tools.

Remediation

Keep PRM scopes_supported a subset of the authorization server's scopes_supported (when the AS publishes one).

References

• RFC 9728 Protected Resource Metadata
• RFC 8414 Authorization Server Metadata

Suppressing

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-SCP04"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31