From 4cd02e36f478a50afa66bfabf7b5dd6a0762e179 Mon Sep 17 00:00:00 2001
From: Ben Senescu <bensenescu@gmail.com>
Date: Fri, 8 May 2026 13:40:26 -0400
Subject: [PATCH] Advertise offline_access in MCP scope metadata

---
 src/lib/auth-config.ts                                   | 3 +--
 src/lib/oauth-resource.ts                                | 1 +
 src/routes/[.]well-known/oauth-protected-resource/mcp.ts | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/lib/auth-config.ts b/src/lib/auth-config.ts
index 5ee7f49..c8d6910 100644
--- a/src/lib/auth-config.ts
+++ b/src/lib/auth-config.ts
@@ -5,11 +5,10 @@ import { getActiveOrganizationId } from "@/lib/auth-session";
 import {
   getMcpOrganizationIdClaim,
   getMcpResource,
+  MCP_OAUTH_SCOPES,
   MCP_SCOPE,
 } from "@/lib/oauth-resource";
 
-const MCP_OAUTH_SCOPES = ["offline_access", MCP_SCOPE];
-
 function assertSingleMcpAudience(audiences: string[]) {
   if (audiences.length !== 1) {
     throw new Error(
diff --git a/src/lib/oauth-resource.ts b/src/lib/oauth-resource.ts
index 9ae51c0..afb859b 100644
--- a/src/lib/oauth-resource.ts
+++ b/src/lib/oauth-resource.ts
@@ -1,5 +1,6 @@
 const MCP_RESOURCE_PATH = "/mcp";
 export const MCP_SCOPE = "mcp";
+export const MCP_OAUTH_SCOPES = ["offline_access", MCP_SCOPE];
 
 export function getMcpResource(baseUrl: string) {
   return new URL(MCP_RESOURCE_PATH, baseUrl).toString();
diff --git a/src/routes/[.]well-known/oauth-protected-resource/mcp.ts b/src/routes/[.]well-known/oauth-protected-resource/mcp.ts
index c992b91..4979f71 100644
--- a/src/routes/[.]well-known/oauth-protected-resource/mcp.ts
+++ b/src/routes/[.]well-known/oauth-protected-resource/mcp.ts
@@ -3,7 +3,7 @@ import { env } from "cloudflare:workers";
 import { getHostedBaseUrl, hasHostedAuthConfig } from "@/lib/auth";
 import { isHostedAuthMode } from "@/lib/auth-mode";
 import { getOAuthProviderResourceActions } from "@/lib/oauth-provider-resource-client";
-import { getMcpResource, MCP_SCOPE } from "@/lib/oauth-resource";
+import { getMcpResource, MCP_OAUTH_SCOPES } from "@/lib/oauth-resource";
 
 function unavailableMetadataResponse() {
   if (!isHostedAuthMode(env.AUTH_MODE)) {
@@ -30,7 +30,7 @@ export const Route = createFileRoute(
           await getOAuthProviderResourceActions().getProtectedResourceMetadata({
             resource: getMcpResource(baseUrl),
             authorization_servers: [`${baseUrl}/api/auth`],
-            scopes_supported: [MCP_SCOPE],
+            scopes_supported: [...MCP_OAUTH_SCOPES],
             resource_name: "OpenSEO MCP",
           });