[Server][Auth] SEP-2350: Emit per-operation scopes in insufficient_scope 403 responses (RFC 6750 §3.1)

[chr-hertel]

Implements the server-side portion of SEP-2350 for the MCP Spec 2026-07-28 release.

Tracked by umbrella #338. Client-side scope accumulation is covered by existing #322.

Spec summary

Aligns 403 insufficient_scope responses with RFC 6750 §3.1 — servers report only scopes needed for the current operation, NOT the union of previously granted. Clients are responsible for computing the union of (previously requested ∪ newly challenged) scopes on step-up re-authorization.

PHP SDK changes

• src/Server/Transport/Http/OAuth/ 403 responses must emit ONLY the scopes required for the requested operation in WWW-Authenticate: Bearer error="insufficient_scope" scope="...".
• Audit current middleware — likely needs adjustment if it emits a cumulative scope set.

Related

• Umbrella [2026-07-28] Authorization hardening (OAuth/OIDC) #338
• Client-side accumulation is covered by [Client] Implement OAuth scope handling (WWW-Authenticate, scopes_supported, step-up, retry-limit, omitted) #322 (annotate with SEP-2350 ref)