skills.rest
rkortThinkwise
rkortThinkwiseCOMMUNITY
Explore all skills by this author →
GitHub

mcp-refresh-scopes

Syncs local OAuth scopes for HTTP MCP connectors with server-advertised scopes.

5|Updated Aug 25, 2026
Search Tags:#authorization#oauth#claude code#mcp#connector#scopes#config sync
One-click install
npx skills add https://github.com/rkortThinkwise/sf-mcp-skills-temp --skill mcp-refresh-scopes-rkortthinkwise
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mcp-refresh-scopes
Source: https://github.com/rkortThinkwise/sf-mcp-skills-temp/tree/main/mcp-refresh-scopes
Command: npx skills add https://github.com/rkortThinkwise/sf-mcp-skills-temp --skill mcp-refresh-scopes-rkortthinkwise

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? OAuth scopes configured locally for an MCP connector can silently drift out of sync with what the server actually supports, causing tools to be unexpectedly missing or denied. This Skill detects and fixes that drift by querying the server's OAuth metadata and updating the local config to match. ## Core Features & Use Cases - Scope Drift Detection: Queries the connector's RFC 9728 oauth-protected-resource metadata endpoint and diffs the server's scopes_supported list against the locally configured oauth.scopes string. - Safe Config Updates: Edits only the target connector entry in .claude.json or .mcp.json with a targeted string replacement, avoiding full-file reserialization, and validates the JSON afterward. - Consent Before Widening Access: Prompts for confirmation before adding new scopes, especially write or manage capabilities, so OAuth grants are never silently expanded. - Use Case: Your sf_mcp connector suddenly denies a tool call. Run this Skill to check whether the server now advertises different scopes, sync the local config, and reconnect to pick up the new authorization. ## Quick Start Ask Claude to refresh the OAuth scopes for the sf_mcp connector and resync the local MCP config with what the server currently advertises.

Frequently Asked Questions about mcp-refresh-scopes

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I refresh OAuth scopes for an MCP connector in Claude Code?▼

Query the connector's /.well-known/oauth-protected-resource endpoint to get its current scopes_supported list, then update the oauth.scopes string for that entry in .claude.json or .mcp.json. After editing, reconnect the connector so a new token is issued under the updated scopes.

Why are MCP tools missing or denied even though my connector is configured?▼

Missing or denied tools often mean the locally configured OAuth scopes no longer match what the server advertises. Syncing the scopes from the server's protected-resource metadata resolves this; if scopes already match, the issue is likely server-side role or entity permissions instead.

Where are MCP server OAuth scopes stored in Claude Code?▼

MCP server entries with oauth blocks live under mcpServers in ~/.claude.json, either at the user level or nested under projects["<project path>"].mcpServers, and may also appear in a project-shared .mcp.json file in the repository.

Does updating MCP scopes take effect immediately?▼

No. Updating the config only changes the stored scope string; any existing OAuth token was issued under the old scopes. The connector must reconnect or re-authenticate, for example via /mcp reconnect in Claude Code, before the new scopes take effect.

Can a scope refresh fix Software Factory permission errors?▼

Only if the error stems from scope drift. If the server's advertised scopes already match the local config, the failure is a Software Factory role or entity rights issue inside the domain, which a scope sync cannot diagnose or fix.

Related Skills

Explore More Software Engineering Skills→
racurryracurry
1

mcp-config

Automate MCP server configuration across project and user scopes.

Community
Advanced
ridhijain709ridhijain709

vercel-connect

Obtain scoped OAuth tokens for third-party services via Vercel OIDC authentication.

Community
Advanced
PostHogPostHog
58

diagnosing-failed-warehouse-syncs

Diagnose failing data warehouse syncs and map root causes to recovery actions.

Official
Advanced
RedHatProductSecurityRedHatProductSecurity
47

mcp-client-protected-resource-metadata

Parse OAuth 2.0 Protected Resource Metadata for MCP client authorization server discovery.

Official
Intermediate