# Feature AI-31 - Improve granularity of oauth-protected-resource metadata

Project: Stream AI
Status: rejected
URL: https://community.openproject.org/work_packages/AI-31

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-11-14 – 2026-03-31 |
| Priority | Medium |
| Target versions | 17.2.0 |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Labor costs |  |

## Description

**As** Claude MCP client,  
**I want to** have a separate metadata endpoint per API scope,  
**so that** the `scopes_supported` only list scopes that I can safely request for MCP calls.

**Acceptance criteria**

  - For each of our API scopes (APIv3, SCIM, MCP), we offer a separate oauth-protected-resource metadata endpoint

  - Each of them only lists `scopes_supported` that are valid in their specific context

  - The WWW-Authenticate header returned for requests to these endpoints indicates the specific metadata endpoint

  - The generic metadata endpoint implemented so far remains available as a default

**Technical notes**

While our current implementation is technically correct, it seems to confuse MCP clients that expect to be able to request all scopes indicated as supported. Obtaining less than "all available permissions" doesn't seem to be part of their coding.

**References**

  - [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728)