Struct McpServerAuthRequiredState 

pub struct McpServerAuthRequiredState {
    pub reason: McpAuthRequiredReason,
    pub oauth_client: Option<McpOAuthClient>,
    pub resource: ProtectedResourceMetadata,
    pub required_scopes: Option<Vec<String>>,
    pub description: Option<String>,
}

Server is reachable but cannot serve requests until the client authenticates. Mirrors the discovery flow defined by RFC 9728 (Protected Resource Metadata) and the OAuth 2.1 / RFC 6750 challenge semantics required by the MCP authorization spec.

Clients react to this state by calling the existing authenticate command with the {@link ProtectedResourceMetadata.resource | resource} carried here. There is no notify/authRequired notification for MCP servers — the action stream is the single source of truth.

When the transition is triggered by a request issued during a turn — most commonly {@link McpAuthRequiredReason.InsufficientScope | InsufficientScope} surfacing mid-tool-call — the host SHOULD also raise {@link SessionStatus.InputNeeded} on the session so the block is visible at the summary level. Clients SHOULD watch this status on any MCP server backing a running tool call and surface an explicit affordance (e.g. a “grant additional access” prompt) tied to that tool call, rather than relying on the user to notice the customization’s status badge.

Fields

reason: McpAuthRequiredReason

Why authentication is required.

oauth_client: Option<McpOAuthClient>

Pre-registered OAuth client to use for authorization. When present, clients MUST use these credentials instead of dynamic client registration.

resource: ProtectedResourceMetadata

RFC 9728 Protected Resource Metadata. The resource field is the canonical MCP server URI per RFC 8707, used as the OAuth resource indicator. authorization_servers is REQUIRED by the MCP authorization spec.

required_scopes: Option<Vec<String>>

Scopes required for the current challenge, parsed from the WWW-Authenticate: Bearer scope="…" header (or scopes_supported fallback). Authoritative for the next authorization request — clients MUST NOT assume any subset/superset relationship to resource.scopes_supported.

description: Option<String>

Human-readable hint, typically from the OAuth error_description.

Trait Implementations

impl Clone for McpServerAuthRequiredState

fn clone(&self) -> McpServerAuthRequiredState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for McpServerAuthRequiredState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for McpServerAuthRequiredState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for McpServerAuthRequiredState

fn eq(&self, other: &McpServerAuthRequiredState) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for McpServerAuthRequiredState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for McpServerAuthRequiredState