When discovering OAuth configuration for MCP servers, the scopes_supported
field from Protected Resource Metadata was being ignored. According to
RFC 9728, Protected Resource Metadata defines scopes specific to that
resource, which should take precedence over Authorization Server Metadata
scopes.
This fix ensures that scopes from Protected Resource Metadata are used
when available, while maintaining backward compatibility by falling back
to Authorization Server Metadata scopes.
Fixes OAuth authorization links missing scope parameter for ModelScope
MCP server.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
64201e8848