A remote MCP server protected by OAuth receives three failing requests: one carries no bearer token, one carries a valid token that lacks the scope a write tool needs, and one is a malformed authorization request. Which HTTP status codes should the server return for these three cases, in that order?
Select an answer to reveal the explanation.
Short Explanation
Think of a club door: no wristband at all gets you a 401, a real wristband that isn't on the VIP list gets you a 403, and a smudged, unreadable form gets you a 400. The trap is swapping 401 and 403 — 401 is about who you are, 403 is about what you're allowed to do.
Full Explanation
The MCP authorization specification maps authorization failures to three HTTP status codes. A 401 Unauthorized means authorization is required or the presented token is invalid or expired, so a request with no bearer token gets 401, usually with a WWW-Authenticate header pointing to the Protected Resource Metadata. A 403 Forbidden means the caller is identified but lacks permission; for a runtime scope shortfall the server SHOULD add error="insufficient_scope" and the needed scopes so the client can step up. A 400 Bad Request covers a malformed authorization request. Returning 400 for the scope problem hides the fact that a step-up flow would fix it, and returning 403 for the scope-less write request in place of the missing-token case misleads the client into thinking it is already authenticated. Sending 403 for a missing token, or 401 for a malformed request, likewise points the client toward the wrong recovery. Exam caveat: an expired token is still a 401, not a 403, because the credential itself is no longer valid. Operational check: replay each failure against the server and confirm the status code, then confirm the 403 carries insufficient_scope with a scope list and the 401 carries resource_metadata.