When authenticating from the MCP client to the server, the authentication succeeds with all the dynamic scopes requested. There should be an option to enable or configure only the supported OAuth fields/scopes.

Issue fork mcp-3569845

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

shubhamgoel created an issue. See original summary.

shubhamgoel opened merge request !44

shubhamgoel’s picture

shubhamgoel commented
Status: Active » Needs review

This update introduces OAuth scope-based access control for the Model Context Protocol (MCP) server, allowing administrators to restrict MCP access to OAuth tokens with specific scopes.

Added ModuleHandlerInterface dependency for module detection
New checkbox: "Enable OAuth Scope Validation" — toggles scope-based access control
New checkboxes: "Allowed OAuth Scopes" — multi-select for permitted OAuth scopes from Simple OAuth
Displays a warning notice when Simple OAuth module is not installed
Updated submitForm() to save the OAuth scope configuration

Please review and merge the MR #44