# context_server: Include requested scopes in OAuth DCR flow \(\#63370\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/19e458b78ae0dacdbb91bc528681c5f13eee0cd3)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 19e458b78ae0dacdbb91bc528681c5f13eee0cd3

Requested commit: 19e458b78ae0dacdbb91bc528681c5f13eee0cd3

Commit: 19e458b78ae0dacdbb91bc528681c5f13eee0cd3

Tree: 4ab6ec0f216d82a45f4271280692d3d0374f0d39

Author: Jonathon Anderson

Committer: GitHub

## Message

```
context_server: Include requested scopes in OAuth DCR flow (#63370)

# Objective

Fixes https://github.com/zed-industries/zed/issues/63363

The OAuth DCR flow would register an OAuth app with default (unset)
`scope`. This was incompatible with some MCP servers, including GitLab's
Orbit MCP server, which require OAuth scope(s) that are not part of the
default assigned to DCR apps.

## Solution

The OAuth DCR request now registers with the same set of `scope`
selected for the entire flow, matching the authorization prompt used
later. If the server advertises/requests no particular scopes for
authentication, this field is elided to request a default set of scopes
decided by the server.

## Testing

- Successfully logged in via OAuth to the GitLab.com Orbit MCP server
([ref](https://docs.gitlab.com/orbit/remote/access/mcp/#connect-your-mcp-client))
and MCP server
([ref](https://docs.gitlab.com/user/model_context_protocol/mcp_server/#connect-a-client-to-the-gitlab-mcp-server))
on Linux
- Unit tests confirm `scopes` are preserved in the DCR request body

## Self-Review Checklist:

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content adheres to Zed's UI standards
([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
and
[icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md)
guidelines)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

---

Release Notes:

- Fixed OAuth authentication failure with MCP servers that require
non-default scopes to access MCP endpoints

Signed-off-by: Jonathon Anderson <anderson.jonathonm@gmail.com>
```

## Parents

- [9dbc9e76c14bec905f0db191d4d371eb001b1cfe](https://git.cafe/gitcafe/zed/commit/9dbc9e76c14bec905f0db191d4d371eb001b1cfe?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/19e458b78ae0dacdbb91bc528681c5f13eee0cd3?format=markdown)