Private key jwt scopes

[NSeydoux]

This adds support for a scope parameter in the client credentials OAuth providers as described in #1430.

Motivation and Context

A client may now specify which scopes it requests to the Authorization Server.

How Has This Been Tested?

I have tested against an OAuth-compliant Authorization Server and an MCP Resource Server enforcing access control based on Access Token scopes.

Breaking Changes

No, the change is opt-in and the default behavior remains the same.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (N/A)
• I have added or updated documentation as needed

Additional context

These changes have been backported to v1.x in #1442.

[changeset-bot]

🦋 Changeset detected

Latest commit: 368ec94

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/client	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1443

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1443

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1443

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1443

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1443

commit: 368ec94

[NSeydoux]

@pcarleton in this branch, should I add the changeset then?

[pcarleton]

yep this one needs a changeset

[NSeydoux]

@pcarleton I think this is all set. Since this adds options to the API, I've made it a minor bump, let me know if that wasn't what was expected.