MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up)

Forward-work remainder split out of #100 (the 2026-07-28 RC tracker, now closed — everything actionable there shipped). Nothing here is RC-required; what remains is one blocked v1.1 feature and a tiny MAY.

> **Update 2026-07-11:** CIMD — originally item 2 of this issue — has **shipped** via the #159 train: #167 (from #166) implemented the AS-side flow (HTTPS-URL `client_id` fetch with exact-match validation, caching, SSRF-protected pinned fetch, localhost-redirect mitigations) and advertises `client_id_metadata_document_supported`; #171 added the fixed per-URL fetch rate limiter. Removed from the list below.

## 1. SEP-2350 — scope accumulation in step-up flows · **blocked on per-tool scopes**

> "When re-authorizing, clients **SHOULD** include these scopes alongside any previously granted scopes to avoid losing permissions needed for other operations."

v1 token scoping is role-level (matching human OAuth); per-tool scoping was explicitly deferred to v1.1 in #86 (resolved decisions, item 2). Step-up + scope accumulation only becomes meaningful once per-tool scopes exist. **Unblocks when:** per-tool scopes land.

## 2. (Optional, tiny) SEP-2207 `offline_access` MAY

The required parts of SEP-2207 are satisfied (refresh tokens implemented; PRM correctly does **not** advertise `offline_access` in `scopes_supported`). The remaining bit is a MAY: honoring an explicit `offline_access` scope opt-in at the token endpoint / listing it in AS metadata `scopes_supported`. Fold into SEP-2350 when it lands, or ignore.

## When this moves
- Re-verify against the **final** spec text once the RC promotes to stable on July 28, 2026 (RC→stable diffs are usually small but nonzero).
- SEP-2350 → sub-issue when per-tool scopes (v1.1, #86) is scheduled.

## Context
- Predecessor: #100 (full RC catalog + per-SEP analysis — see it for spec quotes)
- Shipped from that catalog: `iss`/SEP-2468 (#149/#150, v2.1.1) · path-suffixed PRM discovery/SEP-2351 (#133/#134) · **CIMD (#166 → #167, rate-limited in #171)** · SEP-837/2352/2207-required were already satisfied
- Related: core-side modern-era tracker HarperFast/harper#1548
- Spec: https://modelcontextprotocol.io/specification/draft/basic/authorization

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)