Don't override client_metadata.scopes if they are already set

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

The scope selection strategy inside async_auth_flow unconditionally requests all available scopes. This overwrites the scope list that may have been explicitly set by the client. Being able to explicitly set the requested scopes is an important use case, either to reduce the permissions granted or because the server only permits certain scopes (despite advertising others).

From https://github.com/modelcontextprotocol/python-sdk/blob/v1.26.0/src/mcp/client/auth/oauth2.py#L553-L558:

                    # Step 3: Apply scope selection strategy
                    self.context.client_metadata.scope = get_client_metadata_scopes(
                        extract_scope_from_www_auth(response),
                        self.context.protected_resource_metadata,
                        self.context.oauth_metadata,
                    )

This could be conditional on if self.context.client_metadata.scope is None.

I see that this behavior was previously suggested in https://github.com/modelcontextprotocol/python-sdk/pull/1324#discussion_r2410806282 and rejected, on the basis that "Requesting all available scopes allows the authorization server and end-user to determine appropriate permissions during the consent process". However, I think this is worth revisiting. The specific motivating example here is the official SalesForce MCP server: if the client requests scopes that are not authorized for the given client application, the server rejects the request entirely.

Example Code

Python & MCP Python SDK

python 3.12.12
sdk 1.26.0

Commencez dans src/mcp/client/auth/oauth2.py, au niveau du code de sélection du scope dans la portée async_auth_flow cité dans l’issue, puis examinez la discussion de la pull request associée et les tests existants du client OAuth. C’est terminé lorsque les valeurs de client_metadata.scope configurées explicitement sont conservées, tandis que la sélection du scope a toujours lieu lorsqu’aucun scope n’a été défini.