Invalid bearer token returns wrong HTTP status

What it means

patchbay sends one tools/list request with a bearer token that cannot be valid. The MCP authorization spec says invalid or expired tokens must receive HTTP 401. This finding fires when the server rejected the token with a different status. The most common one is 403. The difference matters to clients. 401 means the token is not good and the client should get a new one. 403 means the token is fine but not allowed to do this. A client that receives 403 for an expired token has no reason to refresh it, so the user sees a permission error where a silent token refresh would have fixed it. The check stays silent if the server needs no authentication. It also stays silent if the server accepted the made-up token, because that case is AUTH-002.

How to fix

Return 401 with a WWW-Authenticate header for every request that carries an invalid or expired token. Keep 403 for requests with a valid token that lacks the required scope and send WWW-Authenticate with error="insufficient_scope" there.

Spec