OAuth Scope Policy (OAuth/ScopePolicy.php)

Declares the OAuth scopes an MCP HTTP request must present: defaults, JSON-RPC method scopes, and tool scopes for tools/call. Batches use the union. A short token gets 403 insufficient_scope listing every required scope.

// Source: https://github.com/modelcontextprotocol/php-sdk | License: Apache-2.0
// Provided via justclaw.it.com; keep this notice with the code.
<?php

/*
 * This file is part of the official PHP MCP SDK.
 *
 * A collaboration between Symfony and the PHP Foundation.
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

namespace Mcp\Server\Transport\Http\OAuth;

use Mcp\Exception\InvalidArgumentException;

/**
 * Declares which scopes a request needs, enforced by
 * {@see \Mcp\Server\Transport\Http\Middleware\AuthorizationMiddleware}.
 *
 * A request needs the default scopes, plus those of its JSON-RPC method, plus —
 * for `tools/call` — those of the tool it calls. A batch needs the union of its
 * messages.

... (truncated -- full source via MCP)