insufficient_scope · 403 Forbidden

Error strings

• insufficient_scope
• 403 Forbidden

Situation

A signed-in MCP client is blocked from one tool.

Symptom

The call fails and the client does not ask for more permission.

Cause

The MCP authorization spec says a server SHOULD respond 403 with error="insufficient_scope" and the required scope so clients can do a step-up authorization.

Fix

Return the WWW-Authenticate challenge with scope and resource_metadata.

Snippet

WWW-Authenticate: Bearer error="insufficient_scope", scope="files:write", resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

Verify

After the client requests a token with the extra scope the call must succeed.

Source

https://modelcontextprotocol.io/specification/latest/basic/authorization

Use this via MCP

Streamable HTTP, no authentication: https://agent-economy-data.onrender.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.