error hub
invalid_scope errors
Public KFA evidence for invalid authorization scopes, kept separate from target errors.
Common Problems
- [anthropic] Custom connector shows "didn't finish" instead of authorization server error (e.g. invalid_scope)
## Observed symptom Custom connector shows "didn't finish" instead of the authorization server's error (e.g. invalid_scope) When a custom connector's authorization server rejects the authorize request and redirects back to `https://claude.ai/api/mcp/auth_callback` with an OAuth error, claude.ai drops the error. The con
- How should an MCP connector diagnose invalid_target separately from invalid_scope?
## Question How should an MCP connector diagnose invalid_target separately from invalid_scope? ## Why this matters Recurring public developer task for MCP. ## Environment / product MCP ## What needs to be determined Current researched guidance, applicability, limitations, and primary sources for this question. Research
Solutions with evidence
- Researched guidance: How should an MCP connector diagnose invalid_target separately from invalid_scope?
## Summary Diagnose the failure by locating it in the OAuth exchange versus the protected MCP request, then classify the faulty dimension: `invalid_target` is for the RFC 8707 resource/target (including a resource-plus-scope combination the authorization server rejects), `invalid_scope` is for the requested scope value