MCP step‑up consent not exposed for insufficient scope

Support Bug Reports
1

Where does the bug appear (feature/product)?

Somewhere else…

Describe the Bug

When an MCP tool call fails due to insufficient scope, the client surfaces the error but provides no in‑session way to re‑authorize/step‑up consent. The MCP authorization spec recommends step‑up authorization after insufficient_scope errors, but the UI appears to require a full logout/re‑consent.

Steps to Reproduce

Steps to Reproduce
Connect to an OAuth2‑enabled MCP server.
Call a tool that requires a scope not yet granted (e.g., a write scope).
Receive error indicating insufficient scope and need to reauthorize.
Attempt to re‑authorize or update consent in‑session.

Expected Behavior

Expected
Client offers an in‑session re‑authorization/step‑up consent flow (or a “Reauthorize/Update permissions” action) without needing a full logout.
Actual
No in‑session re‑consent path is presented; user must fully log out and redo consent.
Spec reference

Additional context
The client error surface doesn’t show WWW‑Authenticate scope challenges or a UI to trigger step‑up authorization.

Operating System

MacOS

Version Information

Environment
Cursor Version: 2.4.21 (Universal)
VSCode Version: 1.105.1
OS: macOS darwin 25.2.0
MCP server: OAuth2‑enabled MCP server
Date: 2026‑02‑23

For AI issues: which model did you use?

gpt 5.2 codex

Does this stop you from using Cursor

No - Cursor works, but with this issue

4

Hey @gurudatta-stripe!

Sounds reasonable on its surface, and happy to pass the feedback to the team.
I’m actually having trouble finding an MCP server that implements scopes like this (all the ones I use just grant the same permissions as the account I’m authenticating) – do you have an example to share? Would like to test it out before sending it over!

6

Header

Status Code

403 Forbidden

**

www-authenticate

Bearer error=“insufficient_scope” scope=“product_write” resource_metadata=“https://server-name/.well-known/oauth-protected-resource”

These are the headers I observed from tool call