### Problem/Motivation `McpAuthorizeOAuthSubscriber` checks a tool's required scopes on the SDK's `RequestEvent` and refuses a call by throwing `McpAuthorizationDeniedException`. That causes two bugs. **Denials answer HTTP 200 with `-32603`.** Since mcp/sdk 0.8 ([php-sdk#412](https://github.com/modelcontextprotocol/php-sdk/pull/412)), the per-message guard in `Protocol` catches the exception, logs "Uncaught exception while handling message" at error level, and answers `-32603 Internal server error`. The client never gets the 401 or 403 it needs to start or step up OAuth. Details are in https://git.drupalcode.org/project/mcp_server/-/work_items/3585933. `RequestEvent` gives a listener no way to refuse a request; [php-sdk#513](https://github.com/modelcontextprotocol/php-sdk/issues/513) asks for one. **Stdio refuses every gated tool.** `RequestEvent` fires on both transports. Under `drush mcp:server` there is no `Authorization` header, so `OAuthScopeValidator::extractTokenScopes()` returns no scopes and every tool with `authentication_mode: required` is refused, even for uid 1. The MCP authorization spec says stdio implementations SHOULD NOT follow it and should take credentials from the environment. On stdio that is the account `drush mcp:server` runs as, and Drupal permissions apply. The stdio denial is also swallowed: `StdioTransport` reaches the same per-message guard through `BaseTransport::handleMessage()`, so the client sees `-32603`, not `authentication_required`. Scopes on a bearer token are an HTTP concern, so the check belongs at the HTTP layer. ### Proposed resolution Replace `McpAuthorizeOAuthSubscriber` with a PSR-15 middleware tagged `mcp_server.transport_middleware`. mcp_server collects those in `TransportMiddlewareCollector` and runs them in `StreamableHttpTransport` before the SDK reads the message. The SDK's own `AuthorizationMiddleware` works the same way. The middleware: 1. Reads the JSON-RPC message through `getParsedBody()`, not the body stream. The SDK reads the stream once and rewinds only when it is seekable. The parsed body is a list of messages for a batch. Anything other than a `tools/call` passes through. 2. Looks up the tool's `authentication_mode` and `scopes` the way `McpAuthorizeOAuthSubscriber::loadToolConfig()` does today, including the name matching fix from https://git.drupalcode.org/project/mcp_server_oauth/-/work_items/3604047. 3. Validates the token with `OAuthScopeValidator`. 4. On failure, returns the response itself: - HTTP 401 with `-32001`. Core's `PsrResponseSubscriber` converts the PSR-7 response into a plain `Response`, and `AuthenticationErrorSubscriber` adds the `resource_metadata` challenge once https://git.drupalcode.org/project/mcp_server_oauth/-/merge_requests/8 (https://git.drupalcode.org/project/mcp_server_oauth/-/work_items/3604056) drops its `JsonResponse` check. - HTTP 403 with `-32002` and `Bearer error="insufficient_scope"`, plus `scope` and `resource_metadata`. The subscriber does not handle 403s, so the challenge construction moves into a service that both the subscriber and the middleware call. A batch with any denied call is denied as a whole. Batching left the spec in 2025-06-18, but the SDK still serves older protocol versions. `StdioTransport` takes no middleware, so stdio skips the check by construction. A gated tool runs there for an account with the right Drupal permissions. ### Remaining tasks - Land https://git.drupalcode.org/project/mcp_server_oauth/-/merge_requests/7 and https://git.drupalcode.org/project/mcp_server_oauth/-/merge_requests/8 first. Both change `AuthenticationErrorSubscriber`, and !7 changes the `resource_metadata` URL. - Extract the challenge construction into a service used by `AuthenticationErrorSubscriber` and the middleware. - Middleware priority: on mcp/sdk 0.8, `McpServerServiceProvider::alter()` removes the protocol version middleware, so any priority works. On 0.7 it sits at 100, and this middleware goes below it so an unsupported `MCP-Protocol-Version` is rejected before a scope decision (https://git.drupalcode.org/project/mcp_server/-/work_items/3585936). - Kernel test that sends a denied `tools/call` through `/mcp` and asserts the 401 with `-32001` and `WWW-Authenticate`, and the 403 with `-32002`. Send the denied call on both `2025-11-25` and `2026-07-28`: on mcp/sdk 0.8 the modern era skips `RequestEvent`, so the current subscriber never checks scopes there. jurgenhaas wrote this shape of test in https://git.drupalcode.org/project/mcp_server/-/merge_requests/81 and offered to port it once the middleware exists. - Test that a gated tool runs over stdio. - In mcp_server, remove the `catch (McpAuthorizationDeniedException)` blocks in `McpServerController::handle()` and `McpServerCommands::server()`, which nothing reaches once no listener throws on `RequestEvent`, and the `McpAuthorizationDeniedException` branch in `McpExceptionSubscriber::onException()` (https://git.drupalcode.org/project/mcp_server/-/work_items/3585933). Keep `McpAuthorizationDeniedException` until this module stops throwing it. The scopes live as third-party settings on `mcp_tool_config`, which https://git.drupalcode.org/project/mcp_server_tool_bridge/-/work_items/3614078 is replacing. This issue keeps the current lookup; the settings move with that work. ### API changes `McpAuthorizeOAuthSubscriber` is removed. Throwing `McpAuthorizationDeniedException` from a `RequestEvent` listener is no longer a supported way to refuse a call. The middleware decides on the tool name in the request body. `Protocol::handleRequest()` re-reads `$event->getRequest()` after dispatching `RequestEvent`, so a listener that swaps the request can change the tool after authorization. Nothing does this today; document it on the API. ### AI usage (if applicable) * [x] AI Assisted Issue: This issue was generated with AI assistance, but was reviewed and refined by the creator. * [ ] AI Assisted Code: This code was mainly generated by a human, with AI autocompleting or parts AI generated, but under full human supervision. * [ ] AI Generated Code: This code was mainly generated by an AI with human guidance, and reviewed, tested, and refined by a human. * [ ] Vibe Coded: This code was generated by an AI and has only been functionally tested.