Don't override client_metadata.scopes if they are already set

Initial Checks

• I confirm that I'm using the latest version of MCP Python SDK
• I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue

Description

The scope selection strategy inside async_auth_flow unconditionally requests all available scopes. This overwrites the scope list that may have been explicitly set by the client. Being able to explicitly set the requested scopes is an important use case, either to reduce the permissions granted or because the server only permits certain scopes (despite advertising others).

From https://github.com/modelcontextprotocol/python-sdk/blob/v1.26.0/src/mcp/client/auth/oauth2.py#L553-L558:

                    # Step 3: Apply scope selection strategy
                    self.context.client_metadata.scope = get_client_metadata_scopes(
                        extract_scope_from_www_auth(response),
                        self.context.protected_resource_metadata,
                        self.context.oauth_metadata,
                    )

This could be conditional on if self.context.client_metadata.scope is None.

I see that this behavior was previously suggested in https://github.com/modelcontextprotocol/python-sdk/pull/1324#discussion_r2410806282 and rejected, on the basis that "Requesting all available scopes allows the authorization server and end-user to determine appropriate permissions during the consent process". However, I think this is worth revisiting. The specific motivating example here is the official SalesForce MCP server: if the client requests scopes that are not authorized for the given client application, the server rejects the request entirely.

Example Code

Python & MCP Python SDK

python 3.12.12
sdk 1.26.0

從 src/mcp/client/auth/oauth2.py 中 issue 引用的 async_auth_flow 範圍選取程式碼開始，接著檢視連結的 pull request 討論和現有的 OAuth 用戶端測試。完成的條件是，明確設定的 client_metadata.scope 值會保留，同時在未設定任何 scope 時仍會進行 scope 選取。