# Objective

Fixes https://github.com/zed-industries/zed/issues/63363

The OAuth DCR flow would register an OAuth app with default (unset)
`scope`. This was incompatible with some MCP servers, including GitLab's
Orbit MCP server, which require OAuth scope(s) that are not part of the
default assigned to DCR apps.

## Solution

The OAuth DCR request now registers with the same set of `scope`
selected for the entire flow, matching the authorization prompt used
later. If the server advertises/requests no particular scopes for
authentication, this field is elided to request a default set of scopes
decided by the server.

## Testing

- Successfully logged in via OAuth to the GitLab.com Orbit MCP server
([ref](https://docs.gitlab.com/orbit/remote/access/mcp/#connect-your-mcp-client))
and MCP server
([ref](https://docs.gitlab.com/user/model_context_protocol/mcp_server/#connect-a-client-to-the-gitlab-mcp-server))
on Linux
- Unit tests confirm `scopes` are preserved in the DCR request body

## Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

---

Release Notes:

- Fixed OAuth authentication failure with MCP servers that require
non-default scopes to access MCP endpoints

Signed-off-by: Jonathon Anderson <anderson.jonathonm@gmail.com>