401 and error for a request with no authorization header (for a request with no token) - as per spec no error should be added #3769

What happened?

Title: Auth spec conformance (minor): 401 challenge contents,
Environment: mcp 2.3.0 · Python 3.12.3 · spec revision 2026-07-28
A small difference from the spec text, only shows up in a corner case.

1. The 401 for a request with no token

RequireAuthMiddleware._send_auth_error sends error="invalid_token" both for a missing token and for an invalid one, and never adds scope, even when required_scopes is set.

Output: 401 Bearer error="invalid_token", error_description="Authentication required", resource_metadata="http://localhost:8001/.well-known/oauth-protected-resource/mcp"

What did you expect?

1. The 401 for a request with no token

RFC 6750 §3.1: when a request lacks any authentication, the resource server "SHOULD NOT include an error code or other error information". MCP Scope Selection Strategy: servers "SHOULD include a scope parameter in the WWW-Authenticate header". The spec's own 401 example carries resource_metadata and scope, and no error.

Expected (no token): Bearer resource_metadata="…", scope="files:read"

Code to reproduce

### 1. The 401 for a request with no token
import asyncio, httpx2
from mcp.server.auth.provider import AccessToken
from mcp.server.auth.settings import AuthSettings
from mcp.server.mcpserver import MCPServer

class RejectAll:
    async def verify_token(self, token: str) -> AccessToken | None: return None

async def main() -> None:
    server = MCPServer("s", token_verifier=RejectAll(), auth=AuthSettings(
        issuer_url="https://as.example", resource_server_url="http://localhost:8001/mcp",
        required_scopes=["files:read"], validate_token_resource=True))
    app = server.streamable_http_app(stateless_http=True)
    async with app.router.lifespan_context(app):
        async with httpx2.AsyncClient(transport=httpx2.ASGITransport(app=app), base_url="http://localhost:8001") as c:
            r = await c.post("/mcp", json={"jsonrpc": "2.0", "id": 1, "method": "tools/list"},
                             headers={"Accept": "application/json, text/event-stream"})
            print(r.status_code, r.headers["www-authenticate"])
asyncio.run(main())

SDK version

2.3.0

Area

Server