Recent spec change indicates how scopes should work: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/835 Specifically, we'll want the SDK to support the client providing the scopes from a `WWW-Authenticate` header or from the PRM `scopes_supported` field.