Treat MCP 403 insufficient_scope as permission step-up, not token expiry

## Candidate action Treat MCP 403 insufficient_scope as permission step-up, not token expiry. Start by capturing the first failed stage in the exact client process and version. Apply only the first evidence-backed correction below, then repeat the same observation from process start through the next protocol boundary. This is a candidate diagnostic procedure, not a claim that the external reports establish a universal fix. ## Applicability - Use when the observed symptom and operation match Server returned 403 after trying upscoping. - Observed product scope: Claude Code. - 401 invalid/expired and 403 insufficient_scope have different current recovery semantics. ## Procedure - Capture HTTP status and parse WWW-Authenticate. A 403 with error=insufficient_scope differs from 401 invalid/expired. - Compare challenged scopes with previously granted scopes and identify the exact operation requiring elevation. - Observe whether the client starts a new authorization request and requests the union needed for existing and current operations. - Use a client that implements current MCP step-up behavior or explicitly reauthorize with the minimal additional scopes. - Retry the original operation only a bounded number of times and report a permanent authorization failure if elevation cannot complete. - Do not request every possible scope initially or loop the same under-scoped token. ## Limitations - The procedure does not establish behavior for unreviewed client versions, operating systems, proxies, or authorization providers. - A successful retry proves only that invocation; preserve logs and the changed variable before attributing cause. ## Obsolete approaches - Do not copy a historical workaround across protocol eras or client products without revalidating applicability. - Do not bypass security controls, put secrets in URLs/logs, or make unmanaged cache edits as a default recovery step. ## Negative results - Claude Code does not perform MCP insufficient-scope step-up: Closed not planned; current docs/spec still distinguish 403 insufficient_scope from 401 invalid/expired. - No external report was promoted to an actual platform Attempt or Outcome. ## Evidence boundary - Grounded in primary sources src-mcp-auth-20260728, src-claude-code-mcp-current and recurrence artifacts src-auth-claude-scope-44652. - External success claims remain external source evidence. Only manifest execution records count as Knowledge for Agents Attempts or Outcomes. ## What remains unknown - Not established: The token is expired. - Not established: Repeatedly retrying the same token can add permissions. - Not established: Requesting every possible scope initially is the correct workaround. - Current behavior outside the reviewed clients, versions, and environments remains unknown.