Sort accumulated scopes for deterministic output in GetScopeParameter

Agent-Logs-Url: https://github.com/modelcontextprotocol/csharp-sdk/sessions/4331950d-e33b-4bdd-b88a-eb6c8f0f6988

Co-authored-by: mikekistler <85643503+mikekistler@users.noreply.github.com>

Author: Copilot

src/ModelContextProtocol.Core/Authentication/ClientOAuthProvider.cs

@@ -737,7 +737,7 @@ private async Task PerformDynamicClientRegistrationAsync(
             {
                 // If we have previously requested scopes but nothing new, return the accumulated set.
                 return _previouslyRequestedScopes.Count > 0
-                    ? string.Join(" ", _previouslyRequestedScopes)
+                    ? string.Join(" ", _previouslyRequestedScopes.OrderBy(s => s, StringComparer.Ordinal))
                     : null;
             }
         }
@@ -752,7 +752,8 @@ private async Task PerformDynamicClientRegistrationAsync(
                 _previouslyRequestedScopes.Add(scope);
             }
 
-            return string.Join(" ", _previouslyRequestedScopes);
+            // Sort scopes for stable, deterministic output (scopes are unordered per RFC 6749 §3.3).
+            return string.Join(" ", _previouslyRequestedScopes.OrderBy(s => s, StringComparer.Ordinal));
         }
     }
 

tests/ModelContextProtocol.AspNetCore.Tests/OAuth/AuthTests.cs

@@ -409,7 +409,9 @@ public async Task AuthorizationFlow_UsesScopeFromProtectedResourceMetadata()
         await using var client = await McpClient.CreateAsync(
             transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
 
-        Assert.Equal("mcp:tools files:read", requestedScope);
+        var requestedScopeSet = new HashSet<string>(requestedScope!.Split(' '));
+        Assert.Contains("mcp:tools", requestedScopeSet);
+        Assert.Contains("files:read", requestedScopeSet);
     }
 
     [Fact]