challengeScope property
Space-delimited OAuth scope advertised on the WWW-Authenticate
challenge emitted with a 401 Unauthorized (MCP 2025-11-25 incremental
scope consent / step-up, SEP-835). When non-null AND OAuth Protected
Resource metadata is configured (Server.configureProtectedResource),
the challenge carries scope="<value>" so the client knows which scopes
to request when (re-)authorizing. Omitted (per spec) when null — the
required scope is then "unknown" and not advertised. Backward compatible:
no effect unless PRM is configured and a 401 is emitted.
Implementation
final String? challengeScope;