Repository navigation
[Server][Auth] SEP-2207: Audit PRM to ensure offline_access is not advertised as a required scope #364
Description
Implements the server-side portion of SEP-2207 for the MCP Spec 2026-07-28 release.
Tracked by umbrella #338.
Spec summary
MCP servers (as resource servers) SHOULD NOT advertise/require
offline_accessin their PRM (Protected Resource Metadata) responses — it's an AS concern, not RS.
PHP SDK changes
- Audit PRM emission in
src/Server/Transport/Http/OAuth/to ensureoffline_accessis NOT included in the server'sscopes_supportedor required-scope advertisements. - Likely a small check/lint plus a unit test guarding against regression.
Related
- Umbrella [2026-07-28] Authorization hardening (OAuth/OIDC) #338
- Client-side
offline_accessrequest in companion sub-issue
Activity
wWzZb commentedon Aug 14, 2026
I can take this. I traced both emission paths:
ProtectedResourceMetadatacurrently preservesoffline_accessin PRM, whileAuthorizationMiddlewarecan add it toWWW-Authenticatefrom either explicit result scopes or the PRM fallback.My plan is to filter the exact
offline_accessscope before both responses are emitted and add regression coverage for mixed andoffline_access-only lists, including the 403 path. I prefer filtering over rejecting the configuration because SEP-2207 uses SHOULD NOT and this keeps existing deployments running. Please let me know if you would rather make it a configuration error.chr-hertel commentedon Aug 19, 2026
Confirmed via #440.
ProtectedResourceMetadata::$scopesSupportedis entirely operator-supplied; nothing in the SDK ever advertisesoffline_access, pinned by a regression test.