fix: accumulate OAuth scopes across 401/403 for progressive authorization

[giulio-leone]

Summary

Fixes #1582

The StreamableHTTPClientTransport overwrites _scope on each 401/403 response instead of accumulating scopes. This causes an infinite re-authorization loop when an MCP server uses per-operation scopes (progressive/step-up authorization):

1. initialize succeeds with scope init
2. tools/list returns 403 → _scope = "mcp:tools:read" (init lost)
3. New token grants mcp:tools:read but not init
4. Next operation needing init fails → _scope = "init" (read lost)
5. Loop between steps 2–4

Changes

• mergeScopes() helper: Computes the set-union of space-delimited OAuth scope strings per RFC 6749 §3.3
• 401 handler (line 522): this._scope = mergeScopes(this._scope, scope)
• 403 handler (line 555): this._scope = mergeScopes(this._scope, scope)

Test

Added accumulates scopes across multiple 403 responses for progressive authorization test that verifies:

1. First 403 sets scope to mcp:tools:read
2. Second 403 accumulates to mcp:tools:read mcp:tools:write
3. Auth is called with the merged scope string

All 253 client tests pass (2 consecutive clean runs).

Note: The Python SDK has the same bug — will submit a companion PR there.

[changeset-bot]

⚠️ No Changeset found

Latest commit: aaa9865

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1604

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1604

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1604

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1604

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1604

commit: 257e73b

[giulio-leone]

Friendly ping — CI is green and this is ready for review. Happy to address any feedback. Thanks!

[giulio-leone]

All CI checks pass. Ready for review.

[pcarleton]

This LGTM, we'll need a changeset before we merge. We may also want to backport this to v1.