diff --git a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
index 7f3cbec27..9945bc366 100644
--- a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
@@ -613,3 +613,73 @@ describe("ClientSettingsForm interactions", () => {
     ).not.toBeInTheDocument();
   });
 });
+
+describe("ClientSettingsForm SEP-837 registration UX", () => {
+  it("renders a registration-rejection alert with the RFC 7591 error detail", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={EMPTY_CLIENT_SETTINGS}
+        expandedSections={[]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+        registrationError={{
+          error: "invalid_redirect_uri",
+          errorDescription: "Loopback redirect URIs are not permitted",
+          status: 400,
+        }}
+      />,
+    );
+    expect(
+      screen.getByText("Client registration was rejected"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/invalid_redirect_uri — .* — HTTP 400/),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/registers as a native client/i),
+    ).toBeInTheDocument();
+  });
+
+  it("falls back to a generic message when no RFC 7591 detail is present", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={EMPTY_CLIENT_SETTINGS}
+        expandedSections={[]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+        registrationError={{}}
+      />,
+    );
+    expect(
+      screen.getByText(
+        "The authorization server rejected client registration.",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it("omits the rejection alert when there is no registration error", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={EMPTY_CLIENT_SETTINGS}
+        expandedSections={[]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+      />,
+    );
+    expect(
+      screen.queryByText("Client registration was rejected"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("reflects DCR's deprecated-in-favor-of-CIMD status in the CIMD section", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={EMPTY_CLIENT_SETTINGS}
+        expandedSections={["cimd"]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+      />,
+    );
+    expect(screen.getByText(/deprecated in favor of/i)).toBeInTheDocument();
+  });
+});
diff --git a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.tsx b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.tsx
index cf89e2a89..c8d8ca772 100644
--- a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.tsx
+++ b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.tsx
@@ -1,6 +1,7 @@
 import { useState } from "react";
 import {
   Accordion,
+  Alert,
   Badge,
   Button,
   Checkbox,
@@ -14,6 +15,7 @@ import type { EmaIdpLoginState } from "@inspector/core/auth/ema/idpSession.js";
 import {
   validateClientSettings,
   type ClientSettingsFormValues,
+  type OAuthRegistrationError,
 } from "./clientSettingsValues.js";
 
 export type ClientSettingsSection = "ema" | "cimd";
@@ -36,6 +38,12 @@ export interface ClientSettingsFormProps {
    * silently dropped without explanation.
    */
   revealErrors?: boolean;
+  /**
+   * Last Dynamic Client Registration rejection from an authorization server
+   * (SEP-837), surfaced so the user can see *why* DCR failed and adjust (switch
+   * to CIMD, fix the redirect URI). Cleared by the parent on the next attempt.
+   */
+  registrationError?: OAuthRegistrationError;
 }
 
 const HintText = Text.withProps({
@@ -43,6 +51,18 @@ const HintText = Text.withProps({
   c: "dimmed",
 });
 
+/** Human-readable one-liner for an RFC 7591 DCR rejection. */
+function registrationRejectionSummary(error: OAuthRegistrationError): string {
+  const parts = [
+    error.error,
+    error.errorDescription,
+    error.status ? `HTTP ${error.status}` : undefined,
+  ].filter(Boolean);
+  return parts.length > 0
+    ? parts.join(" — ")
+    : "The authorization server rejected client registration.";
+}
+
 export function ClientSettingsForm({
   settings,
   expandedSections,
@@ -51,6 +71,7 @@ export function ClientSettingsForm({
   emaIdpLoginState = "none",
   onEmaIdpLogout,
   revealErrors = false,
+  registrationError,
 }: ClientSettingsFormProps) {
   function patch(partial: Partial<ClientSettingsFormValues>) {
     onSettingsChange((prev) => ({ ...prev, ...partial }));
@@ -92,174 +113,216 @@ export function ClientSettingsForm({
     emaIdpLoginState !== "none";
 
   return (
-    <Accordion
-      multiple
-      value={expandedSections}
-      onChange={(value) =>
-        onExpandedSectionsChange(value as ClientSettingsSection[])
-      }
-      variant="separated"
-    >
-      <Accordion.Item value="ema">
-        <Accordion.Control>Enterprise-Managed Authorization</Accordion.Control>
-        <Accordion.Panel>
-          <Stack gap="md">
-            <Checkbox
-              label="Enable enterprise IdP configuration"
-              description="Enterprise-managed authorization signs you in through your organization's IdP instead of each MCP server's own OAuth login. Enable enterprise-managed authorization on participating MCP server's settings."
-              checked={settings.emaEnabled}
-              onChange={(e) => patch({ emaEnabled: e.currentTarget.checked })}
-            />
-            {settings.emaEnabled && (
-              <>
-                <HintText>
-                  Register this redirect URI with your IdP:{" "}
-                  {typeof window !== "undefined"
-                    ? `${window.location.origin}/oauth/callback`
-                    : "http://localhost:6274/oauth/callback"}
-                </HintText>
-                <TextInput
-                  label="Issuer"
-                  description="Your enterprise IdP issuer URL."
-                  value={settings.issuer}
-                  onChange={(e) => patch({ issuer: e.currentTarget.value })}
-                  onBlur={() => setIssuerTouched(true)}
-                  error={showIssuerError}
-                  rightSectionPointerEvents="auto"
-                  rightSection={
-                    settings.issuer ? (
-                      <ClearButton onClick={() => patch({ issuer: "" })} />
-                    ) : null
-                  }
-                />
-                <TextInput
-                  label="Client ID"
-                  description="Client id registered with your enterprise IdP."
-                  value={settings.clientId}
-                  onChange={(e) => patch({ clientId: e.currentTarget.value })}
-                  error={showClientIdError}
-                  rightSectionPointerEvents="auto"
-                  rightSection={
-                    settings.clientId ? (
-                      <ClearButton onClick={() => patch({ clientId: "" })} />
-                    ) : null
-                  }
-                />
-                <TextInput
-                  label="Client Secret"
-                  description="Client secret for your enterprise IdP (if required)."
-                  type="password"
-                  value={settings.clientSecret}
-                  onChange={(e) =>
-                    patch({ clientSecret: e.currentTarget.value })
-                  }
-                  rightSectionPointerEvents="auto"
-                  rightSection={
-                    settings.clientSecret ? (
-                      <ClearButton
-                        onClick={() => patch({ clientSecret: "" })}
-                      />
-                    ) : null
-                  }
-                />
-                {settings.issuer.trim() !== "" && (
-                  <Group
-                    justify="space-between"
-                    align="flex-start"
-                    wrap="nowrap"
-                  >
-                    <Stack gap={4} flex={1}>
-                      <Text size="sm" fw={500}>
-                        IdP sign-in
-                      </Text>
-                      {emaIdpLoginState === "logged_in" ? (
-                        <>
-                          <Badge w="fit-content" color="green" variant="light">
-                            Signed in
-                          </Badge>
-                          <HintText>
-                            Your enterprise IdP session is active. Connecting to
-                            EMA-enabled MCP servers will not prompt for IdP
-                            login until you sign out or the session expires.
-                          </HintText>
-                        </>
-                      ) : emaIdpLoginState === "expired" ? (
-                        <>
-                          <Badge w="fit-content" color="yellow" variant="light">
-                            Session expired
-                          </Badge>
+    <Stack gap="md">
+      {registrationError && (
+        <Alert
+          color="red"
+          variant="light"
+          title="Client registration was rejected"
+        >
+          <Stack gap={4}>
+            <Text size="sm">
+              {registrationRejectionSummary(registrationError)}
+            </Text>
+            <HintText>
+              Inspector registers as a native client (application_type
+              &quot;native&quot;) so authorization servers accept its localhost
+              redirect URI (SEP-837). If the server still rejects Dynamic Client
+              Registration, use a Client ID Metadata Document (below) or a
+              preregistered client instead.
+            </HintText>
+          </Stack>
+        </Alert>
+      )}
+      <Accordion
+        multiple
+        value={expandedSections}
+        onChange={(value) =>
+          onExpandedSectionsChange(value as ClientSettingsSection[])
+        }
+        variant="separated"
+      >
+        <Accordion.Item value="ema">
+          <Accordion.Control>
+            Enterprise-Managed Authorization
+          </Accordion.Control>
+          <Accordion.Panel>
+            <Stack gap="md">
+              <Checkbox
+                label="Enable enterprise IdP configuration"
+                description="Enterprise-managed authorization signs you in through your organization's IdP instead of each MCP server's own OAuth login. Enable enterprise-managed authorization on participating MCP server's settings."
+                checked={settings.emaEnabled}
+                onChange={(e) => patch({ emaEnabled: e.currentTarget.checked })}
+              />
+              {settings.emaEnabled && (
+                <>
+                  <HintText>
+                    Register this redirect URI with your IdP:{" "}
+                    {typeof window !== "undefined"
+                      ? `${window.location.origin}/oauth/callback`
+                      : "http://localhost:6274/oauth/callback"}
+                  </HintText>
+                  <TextInput
+                    label="Issuer"
+                    description="Your enterprise IdP issuer URL."
+                    value={settings.issuer}
+                    onChange={(e) => patch({ issuer: e.currentTarget.value })}
+                    onBlur={() => setIssuerTouched(true)}
+                    error={showIssuerError}
+                    rightSectionPointerEvents="auto"
+                    rightSection={
+                      settings.issuer ? (
+                        <ClearButton onClick={() => patch({ issuer: "" })} />
+                      ) : null
+                    }
+                  />
+                  <TextInput
+                    label="Client ID"
+                    description="Client id registered with your enterprise IdP."
+                    value={settings.clientId}
+                    onChange={(e) => patch({ clientId: e.currentTarget.value })}
+                    error={showClientIdError}
+                    rightSectionPointerEvents="auto"
+                    rightSection={
+                      settings.clientId ? (
+                        <ClearButton onClick={() => patch({ clientId: "" })} />
+                      ) : null
+                    }
+                  />
+                  <TextInput
+                    label="Client Secret"
+                    description="Client secret for your enterprise IdP (if required)."
+                    type="password"
+                    value={settings.clientSecret}
+                    onChange={(e) =>
+                      patch({ clientSecret: e.currentTarget.value })
+                    }
+                    rightSectionPointerEvents="auto"
+                    rightSection={
+                      settings.clientSecret ? (
+                        <ClearButton
+                          onClick={() => patch({ clientSecret: "" })}
+                        />
+                      ) : null
+                    }
+                  />
+                  {settings.issuer.trim() !== "" && (
+                    <Group
+                      justify="space-between"
+                      align="flex-start"
+                      wrap="nowrap"
+                    >
+                      <Stack gap={4} flex={1}>
+                        <Text size="sm" fw={500}>
+                          IdP sign-in
+                        </Text>
+                        {emaIdpLoginState === "logged_in" ? (
+                          <>
+                            <Badge
+                              w="fit-content"
+                              color="green"
+                              variant="light"
+                            >
+                              Signed in
+                            </Badge>
+                            <HintText>
+                              Your enterprise IdP session is active. Connecting
+                              to EMA-enabled MCP servers will not prompt for IdP
+                              login until you sign out or the session expires.
+                            </HintText>
+                          </>
+                        ) : emaIdpLoginState === "expired" ? (
+                          <>
+                            <Badge
+                              w="fit-content"
+                              color="yellow"
+                              variant="light"
+                            >
+                              Session expired
+                            </Badge>
+                            <HintText>
+                              Your cached IdP session has expired. The next
+                              connect to an EMA-enabled server will prompt for
+                              IdP login.
+                            </HintText>
+                          </>
+                        ) : (
                           <HintText>
-                            Your cached IdP session has expired. The next
-                            connect to an EMA-enabled server will prompt for IdP
-                            login.
+                            Not signed in to your enterprise IdP. Connecting to
+                            an EMA-enabled MCP server will open IdP login.
                           </HintText>
-                        </>
-                      ) : (
-                        <HintText>
-                          Not signed in to your enterprise IdP. Connecting to an
-                          EMA-enabled MCP server will open IdP login.
-                        </HintText>
-                      )}
-                    </Stack>
-                    {showIdpSession && onEmaIdpLogout ? (
-                      <Button
-                        variant="light"
-                        color="red"
-                        size="compact-sm"
-                        onClick={onEmaIdpLogout}
-                      >
-                        Sign out
-                      </Button>
-                    ) : null}
-                  </Group>
-                )}
-              </>
-            )}
-          </Stack>
-        </Accordion.Panel>
-      </Accordion.Item>
-      <Accordion.Item value="cimd">
-        <Accordion.Control>OAuth Client ID Metadata Document</Accordion.Control>
-        <Accordion.Panel>
-          <Stack gap="md">
-            <Checkbox
-              label="Use Client ID Metadata Document"
-              description="When the authorization server supports CIMD, Inspector uses this metadata document URL as the client id. The server fetches and verifies the document during OAuth."
-              checked={settings.cimdEnabled}
-              onChange={(e) => patch({ cimdEnabled: e.currentTarget.checked })}
-            />
-            {settings.cimdEnabled && (
-              <>
-                <HintText>
-                  The metadata document must be served over HTTPS and list this
-                  redirect URI:{" "}
-                  {typeof window !== "undefined"
-                    ? `${window.location.origin}/oauth/callback`
-                    : "http://localhost:6274/oauth/callback"}
-                </HintText>
-                <TextInput
-                  label="Client ID metadata document URL"
-                  description="Public HTTPS URL of your OAuth client metadata JSON document."
-                  value={settings.clientMetadataUrl}
-                  onChange={(e) =>
-                    patch({ clientMetadataUrl: e.currentTarget.value })
-                  }
-                  onBlur={() => setClientMetadataUrlTouched(true)}
-                  error={showClientMetadataUrlError}
-                  rightSectionPointerEvents="auto"
-                  rightSection={
-                    settings.clientMetadataUrl ? (
-                      <ClearButton
-                        onClick={() => patch({ clientMetadataUrl: "" })}
-                      />
-                    ) : null
-                  }
-                />
-              </>
-            )}
-          </Stack>
-        </Accordion.Panel>
-      </Accordion.Item>
-    </Accordion>
+                        )}
+                      </Stack>
+                      {showIdpSession && onEmaIdpLogout ? (
+                        <Button
+                          variant="light"
+                          color="red"
+                          size="compact-sm"
+                          onClick={onEmaIdpLogout}
+                        >
+                          Sign out
+                        </Button>
+                      ) : null}
+                    </Group>
+                  )}
+                </>
+              )}
+            </Stack>
+          </Accordion.Panel>
+        </Accordion.Item>
+        <Accordion.Item value="cimd">
+          <Accordion.Control>
+            OAuth Client ID Metadata Document
+          </Accordion.Control>
+          <Accordion.Panel>
+            <Stack gap="md">
+              <HintText>
+                CIMD is the preferred client-identity mechanism in the
+                2026-07-28 spec. Dynamic Client Registration still works and is
+                used by default when CIMD is off, but it is now deprecated in
+                favor of CIMD (SEP-991).
+              </HintText>
+              <Checkbox
+                label="Use Client ID Metadata Document"
+                description="When the authorization server supports CIMD, Inspector uses this metadata document URL as the client id. The server fetches and verifies the document during OAuth."
+                checked={settings.cimdEnabled}
+                onChange={(e) =>
+                  patch({ cimdEnabled: e.currentTarget.checked })
+                }
+              />
+              {settings.cimdEnabled && (
+                <>
+                  <HintText>
+                    The metadata document must be served over HTTPS and list
+                    this redirect URI:{" "}
+                    {typeof window !== "undefined"
+                      ? `${window.location.origin}/oauth/callback`
+                      : "http://localhost:6274/oauth/callback"}
+                  </HintText>
+                  <TextInput
+                    label="Client ID metadata document URL"
+                    description="Public HTTPS URL of your OAuth client metadata JSON document."
+                    value={settings.clientMetadataUrl}
+                    onChange={(e) =>
+                      patch({ clientMetadataUrl: e.currentTarget.value })
+                    }
+                    onBlur={() => setClientMetadataUrlTouched(true)}
+                    error={showClientMetadataUrlError}
+                    rightSectionPointerEvents="auto"
+                    rightSection={
+                      settings.clientMetadataUrl ? (
+                        <ClearButton
+                          onClick={() => patch({ clientMetadataUrl: "" })}
+                        />
+                      ) : null
+                    }
+                  />
+                </>
+              )}
+            </Stack>
+          </Accordion.Panel>
+        </Accordion.Item>
+      </Accordion>
+    </Stack>
   );
 }
diff --git a/clients/web/src/components/groups/ClientSettingsForm/clientSettingsValues.ts b/clients/web/src/components/groups/ClientSettingsForm/clientSettingsValues.ts
index 5e5923688..28c967070 100644
--- a/clients/web/src/components/groups/ClientSettingsForm/clientSettingsValues.ts
+++ b/clients/web/src/components/groups/ClientSettingsForm/clientSettingsValues.ts
@@ -22,6 +22,23 @@ export interface ClientSettingsErrors {
   clientMetadataUrl?: string;
 }
 
+/**
+ * A Dynamic Client Registration rejection surfaced from the authorization
+ * server (SEP-837). Parsed from the SDK's `RegistrationRejectedError` — the
+ * RFC 7591 error JSON (`error` / `error_description`) plus the HTTP status — so
+ * the form can explain *why* registration failed (commonly a redirect-URI
+ * constraint that the `application_type: "native"` declaration is meant to
+ * satisfy) rather than showing a bare failure.
+ */
+export interface OAuthRegistrationError {
+  /** RFC 7591 `error` code (e.g. `invalid_redirect_uri`, `invalid_client_metadata`). */
+  error?: string;
+  /** RFC 7591 `error_description`, if the AS provided one. */
+  errorDescription?: string;
+  /** HTTP status returned by the registration endpoint. */
+  status?: number;
+}
+
 export interface ValidateClientSettingsOptions {
   /**
    * Also flag required fields left blank. Off by default so inline (as-you-type)
diff --git a/clients/web/src/components/groups/NetworkEntry/NetworkEntry.test.tsx b/clients/web/src/components/groups/NetworkEntry/NetworkEntry.test.tsx
index e0c09b5af..2d971ac4b 100644
--- a/clients/web/src/components/groups/NetworkEntry/NetworkEntry.test.tsx
+++ b/clients/web/src/components/groups/NetworkEntry/NetworkEntry.test.tsx
@@ -289,4 +289,24 @@ describe("NetworkEntry", () => {
       screen.queryByRole("button", { name: "Reveal secrets in body" }),
     ).not.toBeInTheDocument();
   });
+
+  it("labels an auth-category request with its OAuth flow phase", () => {
+    const tokenRequest: FetchRequestEntry = {
+      ...baseEntry,
+      url: "https://as.example.com/oauth/token",
+      category: "auth",
+    };
+    renderWithMantine(
+      <NetworkEntry entry={tokenRequest} isListExpanded={false} />,
+    );
+    expect(screen.getByText("Token")).toBeInTheDocument();
+  });
+
+  it("does not label transport requests or unrecognized auth URLs", () => {
+    renderWithMantine(
+      <NetworkEntry entry={baseEntry} isListExpanded={false} />,
+    );
+    expect(screen.queryByText("Token")).not.toBeInTheDocument();
+    expect(screen.queryByText("Discovery")).not.toBeInTheDocument();
+  });
 });
diff --git a/clients/web/src/components/groups/NetworkEntry/NetworkEntry.tsx b/clients/web/src/components/groups/NetworkEntry/NetworkEntry.tsx
index f2c7f33fc..939655445 100644
--- a/clients/web/src/components/groups/NetworkEntry/NetworkEntry.tsx
+++ b/clients/web/src/components/groups/NetworkEntry/NetworkEntry.tsx
@@ -19,6 +19,10 @@ import { ExpandToggle } from "../../elements/ExpandToggle/ExpandToggle";
 import { MethodBadge } from "../../elements/MethodBadge/MethodBadge";
 import { CategoryBadge } from "../../elements/CategoryBadge/CategoryBadge";
 import { maskSecretsInBody } from "../../../utils/maskSecrets";
+import {
+  oauthNetworkPhase,
+  oauthNetworkPhaseLabel,
+} from "../../../utils/oauthNetworkPhase";
 
 export interface NetworkEntryProps {
   entry: FetchRequestEntry;
@@ -247,6 +251,16 @@ export function NetworkEntry({
     setIsExpanded(isListExpanded);
   }, [isListExpanded]);
 
+  // OAuth flow phase for `auth`-category requests (discovery / registration /
+  // authorize / token), so the Network tab labels the auth conversation.
+  const oauthPhase =
+    entry.category === "auth" ? oauthNetworkPhase(entry.url) : undefined;
+  const phaseBadge = oauthPhase ? (
+    <Badge color="violet" variant="light">
+      {oauthNetworkPhaseLabel(oauthPhase)}
+    </Badge>
+  ) : null;
+
   const metaBadges = (
     <>
       {entry.duration != null && (
@@ -278,6 +292,7 @@ export function NetworkEntry({
                 </TimestampText>
                 <MethodBadge method={entry.method} />
                 <CategoryBadge category={entry.category} />
+                {phaseBadge}
               </HeaderCluster>
               <ControlsCluster>{metaBadges}</ControlsCluster>
             </HeaderRow>
@@ -306,6 +321,7 @@ export function NetworkEntry({
                 </TimestampText>
                 <MethodBadge method={entry.method} />
                 <CategoryBadge category={entry.category} />
+                {phaseBadge}
                 <CopyButton value={entry.url} />
                 <UrlText>{entry.url}</UrlText>
               </Group>
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
index 7e514bbfa..68b8c8650 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
@@ -496,6 +496,26 @@ describe("ServerSettingsForm", () => {
     });
   });
 
+  it("invokes onOAuthChange with the chosen insufficient-scope policy (SEP-2350)", async () => {
+    const user = userEvent.setup();
+    const onOAuthChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        onOAuthChange={onOAuthChange}
+        settings={emptySettings}
+        expandedSections={["oauth"]}
+      />,
+    );
+    await user.click(
+      screen.getByRole("textbox", { name: /Insufficient-scope/i }),
+    );
+    await user.click(screen.getByText("Throw (surface the error)"));
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ onInsufficientScope: "throw" }),
+    );
+  });
+
   it("invokes onOAuthChange when enterprise-managed is toggled", async () => {
     const user = userEvent.setup();
     const onOAuthChange = vi.fn();
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
index a3fef83e6..f1869431b 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
@@ -6,6 +6,7 @@ import {
   Flex,
   Group,
   NumberInput,
+  Select,
   Stack,
   Text,
   TextInput,
@@ -255,6 +256,7 @@ export function ServerSettingsForm({
       clientSecret: settings.oauthClientSecret ?? "",
       scopes: settings.oauthScopes ?? "",
       enterpriseManaged: settings.enterpriseManaged ?? false,
+      onInsufficientScope: settings.oauthOnInsufficientScope,
     };
   }
 
@@ -511,6 +513,26 @@ export function ServerSettingsForm({
                   ) : null
                 }
               />
+              <Select
+                label="Insufficient-scope response"
+                description="On a 403 insufficient_scope challenge (SEP-2350): re-authorize with the accumulated scope union, or surface the error to you."
+                data={[
+                  {
+                    value: "reauthorize",
+                    label: "Re-authorize (union scopes)",
+                  },
+                  { value: "throw", label: "Throw (surface the error)" },
+                ]}
+                value={settings.oauthOnInsufficientScope ?? "reauthorize"}
+                onChange={(value) =>
+                  onOAuthChange({
+                    ...currentOAuth(),
+                    onInsufficientScope:
+                      value === "throw" ? "throw" : "reauthorize",
+                  })
+                }
+                allowDeselect={false}
+              />
               {onClearStoredOAuth ? (
                 <Flex align="flex-start" gap="sm" wrap="wrap">
                   <ClearStoredOAuthButton onClick={onClearStoredOAuth}>
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
index 5089e1120..31321f7ca 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
@@ -95,6 +95,29 @@ describe("ServerSettingsModal", () => {
     expect(onClose).toHaveBeenCalled();
   });
 
+  it("maps the OAuth insufficient-scope policy into settings (SEP-2350)", async () => {
+    const user = userEvent.setup();
+    const onSettingsChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsModal
+        opened
+        settings={initialSettings}
+        serverType="streamable-http"
+        isStdio={false}
+        onClose={vi.fn()}
+        onSettingsChange={onSettingsChange}
+      />,
+    );
+    await user.click(screen.getByRole("button", { name: /OAuth Settings/i }));
+    await user.click(
+      screen.getByRole("textbox", { name: /Insufficient-scope/i }),
+    );
+    await user.click(screen.getByText("Throw (surface the error)"));
+    expect(onSettingsChange).toHaveBeenCalledWith(
+      expect.objectContaining({ oauthOnInsufficientScope: "throw" }),
+    );
+  });
+
   it("calls onSettingsChange when adding a header after expanding the section", async () => {
     const user = userEvent.setup();
     const onSettingsChange = vi.fn();
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
index 1388c46f5..3b442650e 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
@@ -150,6 +150,10 @@ export function ServerSettingsModal({
       oauthClientSecret: oauth.clientSecret,
       oauthScopes: oauth.scopes,
       enterpriseManaged: oauth.enterpriseManaged ? true : undefined,
+      // SEP-2350: persist only the non-default ('throw') so unset servers keep
+      // the SDK's `reauthorize` behavior without writing a spurious field.
+      oauthOnInsufficientScope:
+        oauth.onInsufficientScope === "throw" ? "throw" : undefined,
     });
   }
 
diff --git a/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.test.tsx b/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.test.tsx
index 1fb86efa5..8ac4f47f7 100644
--- a/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.test.tsx
+++ b/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.test.tsx
@@ -26,7 +26,7 @@ describe("StepUpAuthModal", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("lists additional scopes from the challenge, not the SEP-2350 union", () => {
+  it("visualizes the SEP-2350 scope union, tagging carried-over vs newly-required scopes", () => {
     renderWithMantine(
       <StepUpAuthModal
         opened
@@ -40,9 +40,14 @@ describe("StepUpAuthModal", () => {
       screen.getByText(/Additional permissions required/i),
     ).toBeInTheDocument();
     expect(screen.getByText(/get_temp/)).toBeInTheDocument();
+    expect(screen.getByText("Scopes to authorize")).toBeInTheDocument();
+    // The whole union renders — challenged scope tagged "new", the rest carried
+    // over from the prior grant and tagged "already granted".
     expect(screen.getByText("weather:read")).toBeInTheDocument();
-    expect(screen.queryByText("tools:read")).not.toBeInTheDocument();
-    expect(screen.queryByText("mcp")).not.toBeInTheDocument();
+    expect(screen.getByText("tools:read")).toBeInTheDocument();
+    expect(screen.getByText("mcp")).toBeInTheDocument();
+    expect(screen.getByText("new")).toBeInTheDocument();
+    expect(screen.getAllByText("already granted")).toHaveLength(2);
     expect(
       screen.getByText(
         /redirected to authorize, then returned to the inspector/i,
@@ -50,6 +55,22 @@ describe("StepUpAuthModal", () => {
     ).toBeInTheDocument();
   });
 
+  it("shows only the challenged scopes when there is no prior grant to union", () => {
+    renderWithMantine(
+      <StepUpAuthModal
+        opened
+        challenge={stepUpChallenge}
+        // Union equals the challenged scope — nothing carried over.
+        authorizationScopes={["weather:read"]}
+        onAuthorize={vi.fn()}
+        onCancel={vi.fn()}
+      />,
+    );
+    expect(screen.getByText("Additional scopes needed")).toBeInTheDocument();
+    expect(screen.getByText("weather:read")).toBeInTheDocument();
+    expect(screen.queryByText("Scopes to authorize")).not.toBeInTheDocument();
+  });
+
   it("uses EMA copy when enterpriseManaged is true", () => {
     renderWithMantine(
       <StepUpAuthModal
diff --git a/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.tsx b/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.tsx
index e3e264e47..bee6cf73d 100644
--- a/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.tsx
+++ b/clients/web/src/components/groups/StepUpAuthModal/StepUpAuthModal.tsx
@@ -1,4 +1,4 @@
-import { Button, Group, List, Modal, Stack, Text } from "@mantine/core";
+import { Badge, Button, Group, List, Modal, Stack, Text } from "@mantine/core";
 import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
 import {
   stepUpAdditionalScopes,
@@ -20,6 +20,12 @@ export interface StepUpAuthModalProps {
 
 const Actions = Group.withProps({ justify: "flex-end", gap: "sm", mt: "md" });
 
+const ScopeToken = Text.withProps({
+  component: "span",
+  ff: "monospace",
+  size: "sm",
+});
+
 export function StepUpAuthModal({
   opened,
   challenge,
@@ -32,6 +38,16 @@ export function StepUpAuthModal({
   const ema = enterpriseManaged === true;
   const handleAuthorize = () => void onAuthorize();
 
+  // SEP-2350: `authorizationScopes` is the union the client will re-authorize
+  // with (previously requested ∪ challenged). Split it so the user sees exactly
+  // what carries over versus what the failing operation newly requires.
+  const additionalSet = new Set(additionalScopes);
+  const unionScopes = authorizationScopes ?? additionalScopes;
+  const carriedOverScopes = unionScopes.filter(
+    (scope) => !additionalSet.has(scope),
+  );
+  const showUnion = !ema && carriedOverScopes.length > 0;
+
   return (
     <Modal
       opened={opened}
@@ -50,7 +66,34 @@ export function StepUpAuthModal({
               )}{" "}
           {stepUpFollowUpMessage({ enterpriseManaged: ema })}
         </Text>
-        {additionalScopes.length > 0 ? (
+        {showUnion ? (
+          <Stack gap="xs">
+            <Text size="sm" fw={600}>
+              Scopes to authorize
+            </Text>
+            <Text size="xs" c="dimmed">
+              Re-authorizing with the union of your previously granted scopes
+              and the ones this operation requires, so the new token keeps every
+              grant (SEP-2350).
+            </Text>
+            <List size="sm" spacing="xs" listStyleType="none">
+              {unionScopes.map((scope) => (
+                <List.Item key={scope}>
+                  <Group gap="xs" wrap="nowrap">
+                    <ScopeToken>{scope}</ScopeToken>
+                    <Badge
+                      size="xs"
+                      variant="light"
+                      color={additionalSet.has(scope) ? "blue" : "gray"}
+                    >
+                      {additionalSet.has(scope) ? "new" : "already granted"}
+                    </Badge>
+                  </Group>
+                </List.Item>
+              ))}
+            </List>
+          </Stack>
+        ) : additionalScopes.length > 0 ? (
           <Stack gap="xs">
             <Text size="sm" fw={600}>
               {ema
@@ -60,20 +103,10 @@ export function StepUpAuthModal({
             <List size="sm" spacing="xs">
               {additionalScopes.map((scope) => (
                 <List.Item key={scope}>
-                  <Text component="span" ff="monospace" size="sm">
-                    {scope}
-                  </Text>
+                  <ScopeToken>{scope}</ScopeToken>
                 </List.Item>
               ))}
             </List>
-            {!ema &&
-            authorizationScopes &&
-            authorizationScopes.length > additionalScopes.length ? (
-              <Text size="xs" c="dimmed">
-                The authorization server may also show scopes you already
-                granted during sign-in.
-              </Text>
-            ) : null}
           </Stack>
         ) : null}
         <Actions>
diff --git a/clients/web/src/test/core/auth/connection-state.test.ts b/clients/web/src/test/core/auth/connection-state.test.ts
index 0e70ef077..cb5f351bf 100644
--- a/clients/web/src/test/core/auth/connection-state.test.ts
+++ b/clients/web/src/test/core/auth/connection-state.test.ts
@@ -56,6 +56,9 @@ function createStorage(
     clearIdpSession: vi.fn(),
     clearEnterpriseManagedResourceServers: vi.fn(),
     getCodeVerifier: vi.fn(),
+    getDiscoveryState: vi.fn().mockResolvedValue(undefined),
+    saveDiscoveryState: vi.fn(),
+    clearDiscoveryState: vi.fn(),
   };
 }
 
diff --git a/clients/web/src/test/core/auth/mcpAuth.test.ts b/clients/web/src/test/core/auth/mcpAuth.test.ts
index a1a8717c8..cb265f4f0 100644
--- a/clients/web/src/test/core/auth/mcpAuth.test.ts
+++ b/clients/web/src/test/core/auth/mcpAuth.test.ts
@@ -1,20 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import type { OAuthClientProvider } from "@modelcontextprotocol/client";
 
-const {
-  sdkAuth,
-  discoverOAuthServerInfo,
-  startAuthorization,
-  selectResourceURL,
-  registerClient,
-  isHttpsUrl,
-} = vi.hoisted(() => ({
+const { sdkAuth } = vi.hoisted(() => ({
   sdkAuth: vi.fn(),
-  discoverOAuthServerInfo: vi.fn(),
-  startAuthorization: vi.fn(),
-  selectResourceURL: vi.fn(),
-  registerClient: vi.fn(),
-  isHttpsUrl: vi.fn(),
 }));
 
 vi.mock("@modelcontextprotocol/client", async (importOriginal) => {
@@ -23,20 +11,12 @@ vi.mock("@modelcontextprotocol/client", async (importOriginal) => {
   return {
     ...actual,
     auth: sdkAuth,
-    discoverOAuthServerInfo,
-    selectResourceURL,
-    startAuthorization,
-    registerClient,
-    isHttpsUrl,
   };
 });
 
 import { mcpAuth } from "@inspector/core/auth/mcpAuth.js";
-import { InvalidClientMetadataError } from "@inspector/core/auth/mcpAuth.js";
 
-function makeProvider(
-  overrides: Partial<OAuthClientProvider> = {},
-): OAuthClientProvider {
+function makeProvider(): OAuthClientProvider {
   return {
     redirectUrl: "http://localhost/callback",
     clientMetadata: {
@@ -54,47 +34,22 @@ function makeProvider(
     redirectToAuthorization: vi.fn(),
     saveCodeVerifier: vi.fn(),
     codeVerifier: vi.fn().mockReturnValue("verifier"),
-    ...overrides,
   };
 }
 
-/**
- * Arrange the discovery + authorization mocks used by the
- * `forceReauthorization` (authorize-without-refresh) path.
- */
-function stubForcePath(
-  discovery: Partial<{
-    authorizationServerUrl: string;
-    authorizationServerMetadata: Record<string, unknown>;
-    resourceMetadata: unknown;
-  }> = {},
-): void {
-  discoverOAuthServerInfo.mockResolvedValue({
-    authorizationServerUrl: "https://as.example.com",
-    authorizationServerMetadata: { issuer: "https://as.example.com" },
-    resourceMetadata: undefined,
-    ...discovery,
-  });
-  selectResourceURL.mockResolvedValue(undefined);
-  startAuthorization.mockResolvedValue({
-    authorizationUrl: new URL("https://as.example.com/authorize"),
-    codeVerifier: "cv",
-  });
-}
-
 describe("mcpAuth", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    isHttpsUrl.mockReturnValue(true);
   });
 
-  it("delegates to SDK auth() when forceReauthorization is not set", async () => {
+  it("forwards the authorization-code exchange (incl. iss) to SDK auth()", async () => {
     sdkAuth.mockResolvedValue("AUTHORIZED");
     const provider = makeProvider();
 
     const result = await mcpAuth(provider, {
       serverUrl: "https://mcp.example.com",
       authorizationCode: "code",
+      iss: "https://as.example.com",
       fetchFn: fetch,
     });
 
@@ -102,212 +57,58 @@ describe("mcpAuth", () => {
     expect(sdkAuth).toHaveBeenCalledWith(provider, {
       serverUrl: "https://mcp.example.com",
       authorizationCode: "code",
+      iss: "https://as.example.com",
       scope: undefined,
       resourceMetadataUrl: undefined,
       fetchFn: fetch,
+      skipIssuerMetadataValidation: undefined,
+      forceReauthorization: undefined,
     });
-    expect(discoverOAuthServerInfo).not.toHaveBeenCalled();
   });
 
-  it("rejects forceReauthorization combined with authorizationCode", async () => {
-    const provider = makeProvider();
-
-    await expect(
-      mcpAuth(provider, {
-        serverUrl: "https://mcp.example.com",
-        authorizationCode: "code",
-        forceReauthorization: true,
-      }),
-    ).rejects.toThrow(
-      "forceReauthorization cannot be combined with authorizationCode",
-    );
-    expect(sdkAuth).not.toHaveBeenCalled();
-    expect(discoverOAuthServerInfo).not.toHaveBeenCalled();
-  });
-
-  it("uses discovery + startAuthorization when forceReauthorization is true", async () => {
-    stubForcePath();
+  it("forwards forceReauthorization + skipIssuerMetadataValidation to SDK auth()", async () => {
+    sdkAuth.mockResolvedValue("REDIRECT");
     const provider = makeProvider();
 
     const result = await mcpAuth(provider, {
       serverUrl: "https://mcp.example.com",
       scope: "mcp weather:read",
       forceReauthorization: true,
-      fetchFn: fetch,
+      skipIssuerMetadataValidation: true,
     });
 
     expect(result).toBe("REDIRECT");
-    expect(sdkAuth).not.toHaveBeenCalled();
-    expect(startAuthorization).toHaveBeenCalled();
-    expect(provider.saveCodeVerifier).toHaveBeenCalledWith("cv");
-    expect(provider.redirectToAuthorization).toHaveBeenCalled();
-  });
-
-  it("persists discovery state and forwards the selected resource + state", async () => {
-    stubForcePath({
-      resourceMetadata: { resource: "https://mcp.example.com" },
-    });
-    selectResourceURL.mockResolvedValue(new URL("https://mcp.example.com/r"));
-    const saveDiscoveryState = vi.fn().mockResolvedValue(undefined);
-    const state = vi.fn().mockResolvedValue("state-123");
-    const provider = makeProvider({ saveDiscoveryState, state });
-
-    await mcpAuth(provider, {
-      serverUrl: "https://mcp.example.com",
-      resourceMetadataUrl: new URL("https://mcp.example.com/.well-known/x"),
-      forceReauthorization: true,
-    });
-
-    expect(saveDiscoveryState).toHaveBeenCalledWith(
+    expect(sdkAuth).toHaveBeenCalledWith(
+      provider,
       expect.objectContaining({
-        authorizationServerUrl: "https://as.example.com",
-        resourceMetadataUrl: "https://mcp.example.com/.well-known/x",
-      }),
-    );
-    expect(state).toHaveBeenCalled();
-    expect(startAuthorization).toHaveBeenCalledWith(
-      "https://as.example.com",
-      expect.objectContaining({
-        state: "state-123",
-        resource: new URL("https://mcp.example.com/r"),
+        scope: "mcp weather:read",
+        forceReauthorization: true,
+        skipIssuerMetadataValidation: true,
       }),
     );
   });
 
-  it("derives scope from resourceMetadata.scopes_supported when no scope given", async () => {
-    stubForcePath({
-      resourceMetadata: { scopes_supported: ["mcp", "weather:read"] },
-    });
+  it("rejects forceReauthorization combined with authorizationCode without calling SDK auth()", async () => {
     const provider = makeProvider();
 
-    await mcpAuth(provider, {
-      serverUrl: "https://mcp.example.com",
-      forceReauthorization: true,
-    });
-
-    expect(startAuthorization).toHaveBeenCalledWith(
-      "https://as.example.com",
-      expect.objectContaining({ scope: "mcp weather:read" }),
-    );
-  });
-
-  it("falls back to clientMetadata.scope when nothing else provides scope", async () => {
-    stubForcePath();
-    const provider = makeProvider({
-      clientMetadata: {
-        ...makeProvider().clientMetadata,
-        scope: "fallback:scope",
-      },
-    });
-
-    await mcpAuth(provider, {
-      serverUrl: "https://mcp.example.com",
-      forceReauthorization: true,
-    });
-
-    expect(startAuthorization).toHaveBeenCalledWith(
-      "https://as.example.com",
-      expect.objectContaining({ scope: "fallback:scope" }),
-    );
-  });
-
-  it("dynamically registers a client when no client information exists", async () => {
-    stubForcePath();
-    registerClient.mockResolvedValue({ client_id: "registered" });
-    const saveClientInformation = vi.fn().mockResolvedValue(undefined);
-    const provider = makeProvider({
-      clientInformation: vi.fn().mockResolvedValue(undefined),
-      saveClientInformation,
-    });
-
-    const result = await mcpAuth(provider, {
-      serverUrl: "https://mcp.example.com",
-      scope: "mcp",
-      forceReauthorization: true,
-    });
-
-    expect(result).toBe("REDIRECT");
-    expect(registerClient).toHaveBeenCalledWith(
-      "https://as.example.com",
-      expect.objectContaining({ scope: "mcp" }),
-    );
-    expect(saveClientInformation).toHaveBeenCalledWith({
-      client_id: "registered",
-    });
-  });
-
-  it("uses a URL-based client id when the AS supports it", async () => {
-    stubForcePath({
-      authorizationServerMetadata: {
-        issuer: "https://as.example.com",
-        client_id_metadata_document_supported: true,
-      },
-    });
-    isHttpsUrl.mockReturnValue(true);
-    const saveClientInformation = vi.fn().mockResolvedValue(undefined);
-    const provider = makeProvider({
-      clientInformation: vi.fn().mockResolvedValue(undefined),
-      clientMetadataUrl: "https://app.example.com/client.json",
-      saveClientInformation,
-    });
-
-    await mcpAuth(provider, {
-      serverUrl: "https://mcp.example.com",
-      forceReauthorization: true,
-    });
-
-    expect(registerClient).not.toHaveBeenCalled();
-    expect(saveClientInformation).toHaveBeenCalledWith({
-      client_id: "https://app.example.com/client.json",
-    });
-  });
-
-  it("rejects a non-HTTPS clientMetadataUrl", async () => {
-    stubForcePath();
-    isHttpsUrl.mockReturnValue(false);
-    const provider = makeProvider({
-      clientInformation: vi.fn().mockResolvedValue(undefined),
-      clientMetadataUrl: "http://insecure.example.com/client.json",
-      saveClientInformation: vi.fn(),
-    });
-
-    await expect(
-      mcpAuth(provider, {
-        serverUrl: "https://mcp.example.com",
-        forceReauthorization: true,
-      }),
-    ).rejects.toBeInstanceOf(InvalidClientMetadataError);
-    expect(registerClient).not.toHaveBeenCalled();
-  });
-
-  it("requires saveClientInformation for dynamic registration", async () => {
-    stubForcePath();
-    const provider = makeProvider({
-      clientInformation: vi.fn().mockResolvedValue(undefined),
-      saveClientInformation: undefined,
-    });
-
     await expect(
       mcpAuth(provider, {
         serverUrl: "https://mcp.example.com",
+        authorizationCode: "code",
         forceReauthorization: true,
       }),
     ).rejects.toThrow(
-      "OAuth client information must be saveable for dynamic registration",
+      "forceReauthorization cannot be combined with authorizationCode",
     );
-    expect(registerClient).not.toHaveBeenCalled();
+    expect(sdkAuth).not.toHaveBeenCalled();
   });
 
-  it("requires a redirectUrl for the authorization_code flow", async () => {
-    stubForcePath();
-    const provider = makeProvider({ redirectUrl: undefined });
+  it("propagates the SDK auth() rejection", async () => {
+    sdkAuth.mockRejectedValue(new Error("discovery failed"));
+    const provider = makeProvider();
 
     await expect(
-      mcpAuth(provider, {
-        serverUrl: "https://mcp.example.com",
-        forceReauthorization: true,
-      }),
-    ).rejects.toThrow("redirectUrl is required for authorization_code flow");
-    expect(startAuthorization).not.toHaveBeenCalled();
+      mcpAuth(provider, { serverUrl: "https://mcp.example.com" }),
+    ).rejects.toThrow("discovery failed");
   });
 });
diff --git a/clients/web/src/test/core/auth/providers.test.ts b/clients/web/src/test/core/auth/providers.test.ts
index fc0665394..34e59975c 100644
--- a/clients/web/src/test/core/auth/providers.test.ts
+++ b/clients/web/src/test/core/auth/providers.test.ts
@@ -223,7 +223,13 @@ describe("OAuthNavigation", () => {
         saveTokens: vi.fn(async () => undefined),
         saveCodeVerifier: vi.fn(async () => undefined),
         getCodeVerifier: vi.fn().mockResolvedValue(undefined),
-        clear: vi.fn(),
+        clear: vi.fn(async () => undefined),
+        clearTokens: vi.fn(async () => undefined),
+        clearClientInformation: vi.fn(async () => undefined),
+        clearCodeVerifier: vi.fn(async () => undefined),
+        clearDiscoveryState: vi.fn(async () => undefined),
+        getDiscoveryState: vi.fn().mockResolvedValue(undefined),
+        saveDiscoveryState: vi.fn(async () => undefined),
         getServerMetadata: vi.fn().mockResolvedValue(null),
         saveServerMetadata: vi.fn(async () => undefined),
       } as unknown as OAuthStorage;
@@ -362,17 +368,21 @@ describe("OAuthNavigation", () => {
         response_types_supported: ["code"],
       });
 
-      expect(storage.saveTokens).toHaveBeenCalledWith(SERVER, {
-        access_token: "t",
-        token_type: "Bearer",
-      });
+      expect(storage.saveTokens).toHaveBeenCalledWith(
+        SERVER,
+        {
+          access_token: "t",
+          token_type: "Bearer",
+        },
+        { issuer: undefined },
+      );
       expect(storage.saveScope).toHaveBeenCalledWith(SERVER, "openid");
       expect(storage.saveClientInformation).toHaveBeenCalledWith(
         SERVER,
         {
           client_id: "c",
         },
-        { registrationKind: "dcr" },
+        { registrationKind: "dcr", issuer: undefined },
       );
       expect(storage.savePreregisteredClientInformation).toHaveBeenCalledWith(
         SERVER,
@@ -386,5 +396,87 @@ describe("OAuthNavigation", () => {
       expect(typeof state).toBe("string");
       expect(state.length).toBeGreaterThan(0);
     });
+
+    it("declares application_type 'native' in DCR client metadata (SEP-837)", () => {
+      const provider = makeProvider(makeStorage());
+      expect(provider.clientMetadata.application_type).toBe("native");
+    });
+
+    describe("SEP-2352 issuer threading", () => {
+      it("forwards ctx.issuer to storage on clientInformation/tokens reads", async () => {
+        const storage = makeStorage();
+        const provider = makeProvider(storage);
+        const issuer = "https://as.example.com";
+
+        await provider.clientInformation({ issuer });
+        await provider.tokens({ issuer });
+
+        // Preregistered lookup (issuer-independent) then the per-issuer dynamic slot.
+        expect(storage.getClientInformation).toHaveBeenCalledWith(SERVER, true);
+        expect(storage.getClientInformation).toHaveBeenCalledWith(
+          SERVER,
+          false,
+          issuer,
+        );
+        expect(storage.getTokens).toHaveBeenCalledWith(SERVER, issuer);
+      });
+
+      it("keys saves by ctx.issuer and defaults registration kind to dcr", async () => {
+        const storage = makeStorage();
+        const provider = makeProvider(storage);
+        const issuer = "https://as.example.com";
+
+        await provider.saveClientInformation({ client_id: "c" }, { issuer });
+        await provider.saveTokens(
+          { access_token: "t", token_type: "Bearer" },
+          { issuer },
+        );
+
+        expect(storage.saveClientInformation).toHaveBeenCalledWith(
+          SERVER,
+          { client_id: "c" },
+          { registrationKind: "dcr", issuer },
+        );
+        expect(storage.saveTokens).toHaveBeenCalledWith(
+          SERVER,
+          { access_token: "t", token_type: "Bearer" },
+          { issuer },
+        );
+      });
+
+      it("round-trips discovery state to storage", async () => {
+        const storage = makeStorage();
+        const provider = makeProvider(storage);
+        const discoveryState = {
+          authorizationServerUrl: "https://as.example.com",
+        };
+
+        await provider.saveDiscoveryState(discoveryState);
+        await provider.discoveryState();
+
+        expect(storage.saveDiscoveryState).toHaveBeenCalledWith(
+          SERVER,
+          discoveryState,
+        );
+        expect(storage.getDiscoveryState).toHaveBeenCalledWith(SERVER);
+      });
+
+      it("maps invalidateCredentials scopes to the matching storage clear", async () => {
+        const storage = makeStorage();
+        const provider = makeProvider(storage);
+
+        await provider.invalidateCredentials("all");
+        await provider.invalidateCredentials("client");
+        await provider.invalidateCredentials("tokens");
+        await provider.invalidateCredentials("verifier");
+        await provider.invalidateCredentials("discovery");
+
+        expect(storage.clear).toHaveBeenCalledWith(SERVER);
+        expect(storage.clearClientInformation).toHaveBeenCalledWith(SERVER);
+        expect(storage.clearTokens).toHaveBeenCalledWith(SERVER);
+        expect(storage.clearCodeVerifier).toHaveBeenCalledWith(SERVER);
+        expect(storage.clearDiscoveryState).toHaveBeenCalledWith(SERVER);
+      });
+    });
   });
 });
diff --git a/clients/web/src/test/core/auth/storage-browser.test.ts b/clients/web/src/test/core/auth/storage-browser.test.ts
index 951d20385..8fb99cb15 100644
--- a/clients/web/src/test/core/auth/storage-browser.test.ts
+++ b/clients/web/src/test/core/auth/storage-browser.test.ts
@@ -429,4 +429,216 @@ describe("BrowserOAuthStorage", () => {
       );
     });
   });
+
+  describe("SEP-2352 per-issuer keying", () => {
+    const issuerA = "https://as-a.example.com";
+    const issuerB = "https://as-b.example.com";
+
+    it("keeps separate client registrations per issuer and re-attaches the issuer stamp on read", async () => {
+      await storage.saveClientInformation(
+        testServerUrl,
+        { client_id: "client-a" },
+        { registrationKind: "dcr", issuer: issuerA },
+      );
+      await storage.saveClientInformation(
+        testServerUrl,
+        { client_id: "client-b" },
+        { registrationKind: "cimd", issuer: issuerB },
+      );
+
+      // Each issuer resolves its own credentials, stamped with its issuer
+      // (SEP-2352) — the stamp is what lets the SDK reject cross-AS reuse.
+      expect(
+        await storage.getClientInformation(testServerUrl, false, issuerA),
+      ).toEqual({ client_id: "client-a", issuer: issuerA });
+      expect(
+        await storage.getClientInformation(testServerUrl, false, issuerB),
+      ).toEqual({ client_id: "client-b", issuer: issuerB });
+      expect(
+        await storage.getClientRegistrationKind(testServerUrl, issuerA),
+      ).toBe("dcr");
+      expect(
+        await storage.getClientRegistrationKind(testServerUrl, issuerB),
+      ).toBe("cimd");
+    });
+
+    it("answers a ctx-less token read from the most-recently-saved (active) issuer", async () => {
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-a", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-b", token_type: "Bearer" },
+        { issuer: issuerB },
+      );
+
+      // No issuer → active issuer (last saved = B); the per-request bearer read.
+      expect(await storage.getTokens(testServerUrl)).toEqual({
+        access_token: "tok-b",
+        token_type: "Bearer",
+        issuer: issuerB,
+      });
+      // Explicit issuer selects that AS's tokens.
+      expect(await storage.getTokens(testServerUrl, issuerA)).toEqual({
+        access_token: "tok-a",
+        token_type: "Bearer",
+        issuer: issuerA,
+      });
+    });
+
+    it("promotes the legacy unkeyed slot: an unstamped token read falls back, then a stamped save supersedes it", async () => {
+      // Legacy pre-1625 blob: unstamped tokens at the top level.
+      await storage.saveTokens(testServerUrl, {
+        access_token: "legacy",
+        token_type: "Bearer",
+      });
+      // Read for a specific issuer falls back to the unkeyed slot (unstamped).
+      expect(await storage.getTokens(testServerUrl, issuerA)).toEqual({
+        access_token: "legacy",
+        token_type: "Bearer",
+      });
+
+      // First stamped save promotes into byIssuer and clears the fallback.
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "fresh", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+      expect(await storage.getTokens(testServerUrl, issuerA)).toEqual({
+        access_token: "fresh",
+        token_type: "Bearer",
+        issuer: issuerA,
+      });
+    });
+
+    it("clears a single issuer's tokens, leaving other issuers intact", async () => {
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-a", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-b", token_type: "Bearer" },
+        { issuer: issuerB },
+      );
+
+      await storage.clearTokens(testServerUrl, issuerA);
+
+      expect(await storage.getTokens(testServerUrl, issuerA)).toBeUndefined();
+      expect(await storage.getTokens(testServerUrl, issuerB)).toMatchObject({
+        access_token: "tok-b",
+      });
+    });
+
+    it("does not stamp a legacy fallback credential when the issuer slot lacks it", async () => {
+      // Legacy unkeyed client info survives, but a byIssuer slot exists for
+      // issuerA holding only tokens (no clientInformation). Reading client info
+      // for issuerA must fall back to the legacy value WITHOUT stamping it with
+      // issuerA — the legacy credential may have been minted by a different AS.
+      await storage.saveClientInformation(
+        testServerUrl,
+        { client_id: "legacy-client" },
+        { registrationKind: "dcr" },
+      );
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-a", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+
+      const clientInfo = await storage.getClientInformation(
+        testServerUrl,
+        false,
+        issuerA,
+      );
+      // No issuer stamp — so the SDK's discardIfIssuerMismatch stays engaged.
+      expect(clientInfo).toEqual({ client_id: "legacy-client" });
+
+      // Symmetric case: legacy tokens survive, slot has only clientInformation.
+      await storage.clear(testServerUrl);
+      await storage.saveTokens(testServerUrl, {
+        access_token: "legacy-tok",
+        token_type: "Bearer",
+      });
+      await storage.saveClientInformation(
+        testServerUrl,
+        { client_id: "client-a" },
+        { registrationKind: "dcr", issuer: issuerA },
+      );
+      const tokens = await storage.getTokens(testServerUrl, issuerA);
+      expect(tokens).toEqual({
+        access_token: "legacy-tok",
+        token_type: "Bearer",
+      });
+    });
+
+    it("does not promote a cleared issuer to the active (ctx-less) slot", async () => {
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-a", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+      // Clearing a *different* issuer must not make it the active issuer.
+      await storage.clearTokens(testServerUrl, issuerB);
+
+      // The ctx-less (per-request bearer) read still resolves issuerA's token.
+      expect(await storage.getTokens(testServerUrl)).toMatchObject({
+        access_token: "tok-a",
+      });
+    });
+
+    it("clears every issuer's tokens/registration when no issuer is given", async () => {
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "tok-a", token_type: "Bearer" },
+        { issuer: issuerA },
+      );
+      await storage.saveClientInformation(
+        testServerUrl,
+        { client_id: "client-b" },
+        { registrationKind: "dcr", issuer: issuerB },
+      );
+
+      await storage.clearTokens(testServerUrl);
+      await storage.clearClientInformation(testServerUrl);
+
+      expect(await storage.getTokens(testServerUrl, issuerA)).toBeUndefined();
+      expect(
+        await storage.getClientInformation(testServerUrl, false, issuerB),
+      ).toBeUndefined();
+    });
+
+    it("tags EMA resource tokens even on the issuer-keyed save path", async () => {
+      await storage.saveTokens(
+        testServerUrl,
+        { access_token: "ema", token_type: "Bearer" },
+        { issuer: issuerA, enterpriseManaged: true },
+      );
+
+      await storage.clearEnterpriseManagedResourceServers();
+
+      expect(await storage.getTokens(testServerUrl, issuerA)).toBeUndefined();
+    });
+  });
+
+  describe("discovery state (SEP-2352)", () => {
+    it("saves, reads, and clears the discovery state", async () => {
+      expect(await storage.getDiscoveryState(testServerUrl)).toBeUndefined();
+
+      const discoveryState = {
+        authorizationServerUrl: "https://as.example.com",
+        resourceMetadataUrl: "https://mcp.example.com/.well-known/x",
+      };
+      await storage.saveDiscoveryState(testServerUrl, discoveryState);
+      expect(await storage.getDiscoveryState(testServerUrl)).toEqual(
+        discoveryState,
+      );
+
+      await storage.clearDiscoveryState(testServerUrl);
+      expect(await storage.getDiscoveryState(testServerUrl)).toBeUndefined();
+    });
+  });
 });
diff --git a/clients/web/src/test/core/mcp/oauthManager.test.ts b/clients/web/src/test/core/mcp/oauthManager.test.ts
index b26538dd9..36e566a11 100644
--- a/clients/web/src/test/core/mcp/oauthManager.test.ts
+++ b/clients/web/src/test/core/mcp/oauthManager.test.ts
@@ -58,6 +58,9 @@ function createMockParams(
     saveIdpSession: vi.fn().mockResolvedValue(undefined),
     clearIdpSession: vi.fn(),
     clearEnterpriseManagedResourceServers: vi.fn(),
+    getDiscoveryState: vi.fn().mockResolvedValue(undefined),
+    saveDiscoveryState: vi.fn().mockResolvedValue(undefined),
+    clearDiscoveryState: vi.fn().mockResolvedValue(undefined),
   };
 
   const redirectUrlProvider = {
@@ -1231,6 +1234,9 @@ describe("OAuthManager", () => {
       expect(
         params.initialConfig.navigation!.navigateToAuthorization,
       ).not.toHaveBeenCalled();
+      // SEP-2350: a step-up redirect is recorded as `scope_step_up`, distinct
+      // from a first-time `authorization_code` login.
+      expect(manager.getOAuthFlowStep()).toBe("scope_step_up");
       captureSpy.mockRestore();
     });
 
diff --git a/clients/web/src/test/core/mcp/serverList.test.ts b/clients/web/src/test/core/mcp/serverList.test.ts
index 5006da05a..c30bd3d8e 100644
--- a/clients/web/src/test/core/mcp/serverList.test.ts
+++ b/clients/web/src/test/core/mcp/serverList.test.ts
@@ -863,6 +863,43 @@ describe("enterpriseManaged oauth settings", () => {
   });
 });
 
+describe("oauthOnInsufficientScope (SEP-2350)", () => {
+  const baseSettings = {
+    headers: [],
+    env: [],
+    metadata: [],
+    connectionTimeout: 0,
+    requestTimeout: 0,
+    taskTtl: 60000,
+    maxFetchRequests: 1000,
+    roots: [],
+  };
+
+  it("lifts oauth.onInsufficientScope to settings", () => {
+    const settings = storedFieldsToInspectorSettings({
+      oauth: { clientId: "cid", onInsufficientScope: "throw" },
+    });
+    expect(settings?.oauthOnInsufficientScope).toBe("throw");
+  });
+
+  it("persists onInsufficientScope under oauth on disk", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthClientId: "cid",
+      oauthOnInsufficientScope: "throw",
+    });
+    expect(stored.oauth?.onInsufficientScope).toBe("throw");
+  });
+
+  it("omits onInsufficientScope when unset", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthClientId: "cid",
+    });
+    expect(stored.oauth?.onInsufficientScope).toBeUndefined();
+  });
+});
+
 describe("envRecordToPairs / envPairsToRecord", () => {
   it("envRecordToPairs preserves key insertion order", () => {
     expect(envRecordToPairs({ B: "2", A: "1" })).toEqual([
diff --git a/clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts b/clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts
index 65cb7a8a2..e062e9cbb 100644
--- a/clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts
+++ b/clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts
@@ -1071,8 +1071,12 @@ describe("InspectorClient OAuth E2E", () => {
 
         expect(client.getStatus()).toBe("connected");
 
+        type StoredTokens = { tokens?: { access_token?: string } };
         type StateShape = {
-          servers?: Record<string, { tokens?: { access_token?: string } }>;
+          servers?: Record<
+            string,
+            StoredTokens & { byIssuer?: Record<string, StoredTokens> }
+          >;
         };
         // Persistence is fire-and-forget; await the write rather than polling.
         await flushStoreFileWrites(customPath);
@@ -1081,8 +1085,16 @@ describe("InspectorClient OAuth E2E", () => {
         ) as StateShape;
         const servers = parsed.servers ?? {};
         expect(Object.keys(servers).length).toBeGreaterThan(0);
+        // SEP-2352: tokens persist under `byIssuer[issuer].tokens`; accept the
+        // legacy top-level slot too.
         expect(
-          Object.values(servers).some((s) => !!s?.tokens?.access_token),
+          Object.values(servers).some(
+            (s) =>
+              !!s?.tokens?.access_token ||
+              Object.values(s?.byIssuer ?? {}).some(
+                (slot) => !!slot?.tokens?.access_token,
+              ),
+          ),
         ).toBe(true);
       } finally {
         try {
diff --git a/clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-storage-e2e.test.ts b/clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-storage-e2e.test.ts
index 10bb82718..f36f9651c 100644
--- a/clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-storage-e2e.test.ts
+++ b/clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-storage-e2e.test.ts
@@ -351,12 +351,24 @@ describe("InspectorClient OAuth E2E with Remote Storage", () => {
           "oauth",
           remoteAuthToken!,
           (body) => {
+            // SEP-2352: tokens persist under `byIssuer[issuer].tokens`, keyed by
+            // authorization-server issuer. Accept the legacy top-level slot too.
+            type StoredTokens = { tokens?: { access_token?: string } };
             const b = body as {
-              servers?: Record<string, { tokens?: { access_token?: string } }>;
+              servers?: Record<
+                string,
+                StoredTokens & { byIssuer?: Record<string, StoredTokens> }
+              >;
             };
             return !!(
               b?.servers &&
-              Object.values(b.servers).some((s) => s?.tokens?.access_token)
+              Object.values(b.servers).some(
+                (s) =>
+                  s?.tokens?.access_token ||
+                  Object.values(s?.byIssuer ?? {}).some(
+                    (slot) => slot?.tokens?.access_token,
+                  ),
+              )
             );
           },
         );
diff --git a/clients/web/src/test/integration/mcp/node/transport.test.ts b/clients/web/src/test/integration/mcp/node/transport.test.ts
index f72229114..af68081f7 100644
--- a/clients/web/src/test/integration/mcp/node/transport.test.ts
+++ b/clients/web/src/test/integration/mcp/node/transport.test.ts
@@ -259,6 +259,38 @@ describe("Transport", () => {
       }
     });
 
+    it("forwards settings.oauthOnInsufficientScope to the streamable-http transport (SEP-2350)", () => {
+      const config: MCPServerConfig = {
+        type: "streamable-http",
+        url: "https://mcp.example.com/mcp",
+      };
+      const baseSettings: InspectorServerSettings = {
+        headers: [],
+        env: [],
+        metadata: [],
+        connectionTimeout: 0,
+        requestTimeout: 0,
+        taskTtl: 0,
+        maxFetchRequests: 1000,
+        roots: [],
+      };
+
+      const asThrow = createTransportNode(config, {
+        settings: { ...baseSettings, oauthOnInsufficientScope: "throw" },
+      });
+      expect(
+        (asThrow.transport as unknown as { _onInsufficientScope?: string })
+          ._onInsufficientScope,
+      ).toBe("throw");
+
+      // Unset → the SDK's default policy.
+      const asDefault = createTransportNode(config, { settings: baseSettings });
+      expect(
+        (asDefault.transport as unknown as { _onInsufficientScope?: string })
+          ._onInsufficientScope,
+      ).toBe("reauthorize");
+    });
+
     it("applies settings.headers to the outgoing SSE request", async () => {
       const server = createTestServerHttp({
         serverInfo: createTestServerInfo(),
diff --git a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
index 9c76288f6..b558a195f 100644
--- a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
+++ b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
@@ -1478,6 +1478,67 @@ describe("/api/servers routes", () => {
       expect(body.error).toMatch(/settings\.env/);
     });
 
+    it("rejects an invalid settings.oauthOnInsufficientScope with 400", async () => {
+      writeFileSync(
+        h.configPath,
+        JSON.stringify({
+          mcpServers: {
+            srv: { type: "streamable-http", url: "https://x.test/mcp" },
+          },
+        }),
+      );
+      const res = await fetch(`${h.baseUrl}/api/servers/srv`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            env: [],
+            oauthOnInsufficientScope: "nope",
+          },
+        }),
+      });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error?: string };
+      expect(body.error).toMatch(/oauthOnInsufficientScope/);
+    });
+
+    it("persists a valid settings.oauthOnInsufficientScope onto the stored config", async () => {
+      writeFileSync(
+        h.configPath,
+        JSON.stringify({
+          mcpServers: {
+            srv: { type: "streamable-http", url: "https://x.test/mcp" },
+          },
+        }),
+      );
+      const res = await fetch(`${h.baseUrl}/api/servers/srv`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            env: [],
+            oauthOnInsufficientScope: "throw",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      const stored = JSON.parse(readFileSync(h.configPath, "utf-8")) as {
+        mcpServers: Record<
+          string,
+          { oauth?: { onInsufficientScope?: string } }
+        >;
+      };
+      expect(stored.mcpServers.srv?.oauth?.onInsufficientScope).toBe("throw");
+    });
+
     it("ignores settings env/cwd for a non-stdio server (no leak onto config)", async () => {
       writeFileSync(
         h.configPath,
diff --git a/clients/web/src/utils/oauthNetworkPhase.test.ts b/clients/web/src/utils/oauthNetworkPhase.test.ts
new file mode 100644
index 000000000..fa50206cf
--- /dev/null
+++ b/clients/web/src/utils/oauthNetworkPhase.test.ts
@@ -0,0 +1,73 @@
+import { describe, it, expect } from "vitest";
+import { oauthNetworkPhase, oauthNetworkPhaseLabel } from "./oauthNetworkPhase";
+
+describe("oauthNetworkPhase", () => {
+  it("classifies RFC 9728/8414 discovery requests", () => {
+    expect(
+      oauthNetworkPhase(
+        "https://mcp.example.com/.well-known/oauth-protected-resource",
+      ),
+    ).toBe("discovery");
+    expect(
+      oauthNetworkPhase(
+        "https://as.example.com/.well-known/oauth-authorization-server",
+      ),
+    ).toBe("discovery");
+    expect(
+      oauthNetworkPhase(
+        "https://as.example.com/.well-known/openid-configuration",
+      ),
+    ).toBe("discovery");
+  });
+
+  it("classifies registration, token, and authorize endpoints", () => {
+    expect(oauthNetworkPhase("https://as.example.com/register")).toBe(
+      "registration",
+    );
+    expect(oauthNetworkPhase("https://as.example.com/oauth/token")).toBe(
+      "token",
+    );
+    expect(
+      oauthNetworkPhase("https://as.example.com/authorize?state=abc"),
+    ).toBe("authorize");
+  });
+
+  it("matches on the path, ignoring misleading query params", () => {
+    // A `/token` substring in the query must not classify an authorize request.
+    expect(
+      oauthNetworkPhase(
+        "https://as.example.com/authorize?redirect_uri=https://app/token",
+      ),
+    ).toBe("authorize");
+  });
+
+  it("returns undefined for unrelated URLs", () => {
+    expect(oauthNetworkPhase("https://mcp.example.com/mcp")).toBeUndefined();
+  });
+
+  it("matches the endpoint as the final path segment, not a nested one", () => {
+    // A nested segment must not classify as the OAuth endpoint...
+    expect(
+      oauthNetworkPhase("https://as.example.com/oauth/token/refresh"),
+    ).toBeUndefined();
+    expect(
+      oauthNetworkPhase("https://gw.example.com/api/register/foo"),
+    ).toBeUndefined();
+    // ...but a trailing slash on the real endpoint is tolerated.
+    expect(oauthNetworkPhase("https://as.example.com/oauth/token/")).toBe(
+      "token",
+    );
+  });
+
+  it("tolerates a non-absolute URL by stripping the query", () => {
+    expect(oauthNetworkPhase("/register?foo=bar")).toBe("registration");
+    expect(oauthNetworkPhase("not a url")).toBeUndefined();
+  });
+
+  it("maps phases to human-readable labels", () => {
+    expect(oauthNetworkPhaseLabel("discovery")).toBe("Discovery");
+    expect(oauthNetworkPhaseLabel("registration")).toBe("Registration");
+    expect(oauthNetworkPhaseLabel("authorize")).toBe("Authorize");
+    expect(oauthNetworkPhaseLabel("token")).toBe("Token");
+  });
+});
diff --git a/clients/web/src/utils/oauthNetworkPhase.ts b/clients/web/src/utils/oauthNetworkPhase.ts
new file mode 100644
index 000000000..5fd1a1210
--- /dev/null
+++ b/clients/web/src/utils/oauthNetworkPhase.ts
@@ -0,0 +1,62 @@
+/**
+ * Classify a captured `auth`-category network request by its OAuth flow phase,
+ * so the Network tab can label discovery / registration / token / step-up
+ * traffic. Purely heuristic on the request URL — the SDK owns the flow, so this
+ * is presentation only and returns `undefined` when nothing matches.
+ *
+ * Phases follow the 2026-07-28 authorization flow: RFC 9728/8414 discovery,
+ * DCR / CIMD registration (SEP-991), the authorization redirect, and the token
+ * exchange (where a `403 insufficient_scope` step-up re-authorizes, SEP-2350).
+ */
+export type OAuthNetworkPhase =
+  | "discovery"
+  | "registration"
+  | "authorize"
+  | "token";
+
+const PHASE_LABELS: Record<OAuthNetworkPhase, string> = {
+  discovery: "Discovery",
+  registration: "Registration",
+  authorize: "Authorize",
+  token: "Token",
+};
+
+export function oauthNetworkPhase(
+  rawUrl: string,
+): OAuthNetworkPhase | undefined {
+  // Match on the path only; query strings and fragments are irrelevant and can
+  // contain misleading substrings (e.g. a `redirect_uri` pointing at `/token`).
+  let path: string;
+  try {
+    path = new URL(rawUrl).pathname.toLowerCase();
+  } catch {
+    // Not an absolute URL — fall back to the raw string, minus any query.
+    path = rawUrl.toLowerCase().split(/[?#]/)[0] ?? "";
+  }
+
+  if (
+    path.includes("/.well-known/oauth-protected-resource") ||
+    path.includes("/.well-known/oauth-authorization-server") ||
+    path.includes("/.well-known/openid-configuration")
+  ) {
+    return "discovery";
+  }
+  // Match the endpoint as the final path segment (trailing slash tolerated) so a
+  // nested path like `/token/refresh` or `/api/register/foo` is not misclassified.
+  const endpoint = path.replace(/\/+$/, "");
+  if (endpoint.endsWith("/register")) {
+    return "registration";
+  }
+  if (endpoint.endsWith("/token")) {
+    return "token";
+  }
+  if (endpoint.endsWith("/authorize")) {
+    return "authorize";
+  }
+  return undefined;
+}
+
+/** Human-readable badge label for a phase. */
+export function oauthNetworkPhaseLabel(phase: OAuthNetworkPhase): string {
+  return PHASE_LABELS[phase];
+}
diff --git a/core/auth/mcpAuth.ts b/core/auth/mcpAuth.ts
index 4638605e5..8d5b8385f 100644
--- a/core/auth/mcpAuth.ts
+++ b/core/auth/mcpAuth.ts
@@ -1,45 +1,22 @@
 /**
- * v2-shaped OAuth orchestrator for standard MCP resource authorization.
+ * Thin wrapper over the `@modelcontextprotocol/client` v2 OAuth orchestrator.
  *
- * **Upgrade path:** On `@modelcontextprotocol/client` v2, replace this module
- * with `export { auth as mcpAuth, type AuthOptions as McpAuthOptions } from
- * "@modelcontextprotocol/client"` and delete `authorizeWithoutRefresh`.
- *
- * Until then, `mcpAuth` delegates to SDK v1 `auth()` except when
- * `forceReauthorization: true` — then it runs discovery + `startAuthorization`
- * (the same path v2 `auth()` takes when refresh cannot widen scope).
+ * SDK v2's `auth()` handles the full flow natively — including `forceReauthorization`
+ * (skip refresh and start a fresh authorization request when a step-up scope union
+ * cannot be widened by refresh, RFC 6749 §6), RFC 9207 `iss` validation, SEP-2352
+ * issuer stamping/`ctx.issuer` keying, and SEP-837 `application_type` defaults. This
+ * wrapper exists only to pin the option shape (`McpAuthOptions`) the Inspector passes
+ * and to keep a single import site; it no longer reimplements any flow logic.
  */
 
-import {
-  auth as sdkAuth,
-  discoverOAuthServerInfo,
-  isHttpsUrl,
-  registerClient,
-  selectResourceURL,
-  startAuthorization,
-} from "@modelcontextprotocol/client";
+import { auth as sdkAuth } from "@modelcontextprotocol/client";
 import type { OAuthClientProvider } from "@modelcontextprotocol/client";
 import type { FetchLike } from "@modelcontextprotocol/client";
-/**
- * Thrown when the OAuth client metadata the Inspector would register is
- * invalid (e.g. a non-HTTPS `clientMetadataUrl`). SDK v2 moved the original
- * `InvalidClientMetadataError` into `@modelcontextprotocol/server-legacy`,
- * whose `/auth` entry pulls in Node/Express server handlers that must never
- * reach the browser bundle. This local class preserves the thrown type and
- * message for the Inspector's client-side validation without that dependency.
- */
-export class InvalidClientMetadataError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "InvalidClientMetadataError";
-  }
-}
 
 export type McpAuthResult = "AUTHORIZED" | "REDIRECT";
 
 /**
- * Options aligned with v2 SDK `AuthOptions`. v2-only fields are accepted now
- * and forwarded on upgrade; v1 passthrough ignores unsupported fields.
+ * Options forwarded to SDK v2 `auth()`.
  */
 export interface McpAuthOptions {
   serverUrl: string | URL;
@@ -49,11 +26,11 @@ export interface McpAuthOptions {
   scope?: string;
   resourceMetadataUrl?: URL;
   fetchFn?: FetchLike;
-  /** v2 SEP-2468 — ignored until SDK v2 upgrade. */
+  /** SEP-2468 opt-out for the RFC 8414 §3.3 issuer-echo check (security-weakening). */
   skipIssuerMetadataValidation?: boolean;
   /**
-   * Skip refresh and start an authorization-code flow. Required for step-up
-   * when the union scope exceeds the current token grant (RFC 6749 §6).
+   * Skip refresh and start an authorization-code flow. Required for step-up when
+   * the union scope exceeds the current token grant (RFC 6749 §6).
    */
   forceReauthorization?: boolean;
 }
@@ -62,13 +39,10 @@ export async function mcpAuth(
   provider: OAuthClientProvider,
   options: McpAuthOptions,
 ): Promise<McpAuthResult> {
-  if (options.forceReauthorization) {
-    if (options.authorizationCode !== undefined) {
-      throw new Error(
-        "forceReauthorization cannot be combined with authorizationCode",
-      );
-    }
-    return authorizeWithoutRefresh(provider, options);
+  if (options.forceReauthorization && options.authorizationCode !== undefined) {
+    throw new Error(
+      "forceReauthorization cannot be combined with authorizationCode",
+    );
   }
 
   return sdkAuth(provider, {
@@ -78,93 +52,7 @@ export async function mcpAuth(
     scope: options.scope,
     resourceMetadataUrl: options.resourceMetadataUrl,
     fetchFn: options.fetchFn,
+    skipIssuerMetadataValidation: options.skipIssuerMetadataValidation,
+    forceReauthorization: options.forceReauthorization,
   });
 }
-
-async function authorizeWithoutRefresh(
-  provider: OAuthClientProvider,
-  options: McpAuthOptions,
-): Promise<"REDIRECT"> {
-  const { serverUrl, scope, resourceMetadataUrl, fetchFn } = options;
-
-  const serverInfo = await discoverOAuthServerInfo(serverUrl, {
-    resourceMetadataUrl,
-    fetchFn,
-  });
-  const {
-    authorizationServerUrl,
-    authorizationServerMetadata: metadata,
-    resourceMetadata,
-  } = serverInfo;
-
-  await provider.saveDiscoveryState?.({
-    authorizationServerUrl: String(authorizationServerUrl),
-    resourceMetadataUrl: resourceMetadataUrl?.toString(),
-    resourceMetadata,
-    authorizationServerMetadata: metadata,
-  });
-
-  const resource = await selectResourceURL(
-    serverUrl,
-    provider,
-    resourceMetadata,
-  );
-
-  const resolvedScope =
-    scope ||
-    resourceMetadata?.scopes_supported?.join(" ") ||
-    provider.clientMetadata.scope;
-
-  let clientInformation = await Promise.resolve(provider.clientInformation());
-  if (!clientInformation) {
-    const supportsUrlBasedClientId =
-      metadata?.client_id_metadata_document_supported === true;
-    const clientMetadataUrl = provider.clientMetadataUrl;
-    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) {
-      throw new InvalidClientMetadataError(
-        `clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`,
-      );
-    }
-    const shouldUseUrlBasedClientId =
-      supportsUrlBasedClientId && clientMetadataUrl;
-    if (shouldUseUrlBasedClientId) {
-      clientInformation = { client_id: clientMetadataUrl };
-      await provider.saveClientInformation?.(clientInformation);
-    } else {
-      if (!provider.saveClientInformation) {
-        throw new Error(
-          "OAuth client information must be saveable for dynamic registration",
-        );
-      }
-      const fullInformation = await registerClient(authorizationServerUrl, {
-        metadata,
-        clientMetadata: provider.clientMetadata,
-        scope: resolvedScope,
-        fetchFn,
-      });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
-    }
-  }
-
-  const state = provider.state ? await provider.state() : undefined;
-  const redirectUrl = provider.redirectUrl;
-  if (!redirectUrl) {
-    throw new Error("redirectUrl is required for authorization_code flow");
-  }
-  const { authorizationUrl, codeVerifier } = await startAuthorization(
-    authorizationServerUrl,
-    {
-      metadata,
-      clientInformation,
-      state,
-      redirectUrl,
-      scope: resolvedScope,
-      resource,
-    },
-  );
-
-  await provider.saveCodeVerifier(codeVerifier);
-  await provider.redirectToAuthorization(authorizationUrl);
-  return "REDIRECT";
-}
diff --git a/core/auth/oauth-storage.ts b/core/auth/oauth-storage.ts
index cef19cc38..f68baa64c 100644
--- a/core/auth/oauth-storage.ts
+++ b/core/auth/oauth-storage.ts
@@ -2,13 +2,18 @@ import type {
   OAuthClientInformation,
   OAuthTokens,
   OAuthMetadata,
+  OAuthDiscoveryState,
 } from "@modelcontextprotocol/client";
 import {
   OAuthClientInformationSchema,
   OAuthTokensSchema,
 } from "@modelcontextprotocol/core";
 import type { OAuthStorage } from "./storage.js";
-import { type OAuthMemoryStore, type ServerOAuthState } from "./store.js";
+import {
+  type OAuthMemoryStore,
+  type ServerOAuthState,
+  type IssuerBoundOAuthState,
+} from "./store.js";
 import type { OAuthPersistBackend } from "./oauth-persist.js";
 import type {
   IdpSessionState,
@@ -17,6 +22,16 @@ import type {
   SaveTokensOptions,
 } from "./storage.js";
 
+/**
+ * Re-attach the `issuer` stamp (SEP-2352) that `OAuthTokensSchema` /
+ * `OAuthClientInformationSchema` strip on parse. The stamp is the `byIssuer` key,
+ * so it is recovered from the key rather than the parsed value — this is what lets
+ * the SDK's `discardIfIssuerMismatch` reject cross-AS credential reuse.
+ */
+function withIssuer<T extends object>(value: T, issuer: string | undefined): T {
+  return issuer === undefined ? value : { ...value, issuer };
+}
+
 /**
  * Concrete OAuthStorage implementation backed by in-memory state and an explicit
  * persist backend (file, remote HTTP, sessionStorage, …).
@@ -66,29 +81,109 @@ export class OAuthStorageBase implements OAuthStorage {
     await tracked;
   }
 
+  /**
+   * Resolve the AS-`issuer` key whose credentials answer a read. An explicit
+   * `issuer` (from the SDK's `ctx.issuer`) wins; otherwise the most-recently-saved
+   * `activeIssuer` answers the transport's ctx-less per-request bearer read.
+   */
+  private resolveReadIssuer(
+    state: ServerOAuthState,
+    issuer?: string,
+  ): string | undefined {
+    return issuer ?? state.activeIssuer;
+  }
+
+  /** Read the issuer-bound slot for a read, if one exists. */
+  private issuerSlot(
+    state: ServerOAuthState,
+    issuer?: string,
+  ): IssuerBoundOAuthState | undefined {
+    const key = this.resolveReadIssuer(state, issuer);
+    return key ? state.byIssuer?.[key] : undefined;
+  }
+
+  /**
+   * Read-modify-write the `byIssuer[issuer]` slot, set `activeIssuer`, and clear
+   * the given legacy top-level fallback fields (lazy migration — the fallback is
+   * promoted into the keyed slot on first issuer-stamped save).
+   */
+  private updateIssuerSlot(
+    serverUrl: string,
+    issuer: string,
+    updates: Partial<IssuerBoundOAuthState>,
+    clearLegacy: Partial<ServerOAuthState>,
+    // Saves promote the issuer to `activeIssuer` (it answers ctx-less reads);
+    // clears must not — clearing one AS's credentials shouldn't make it the
+    // active one.
+    setActive = true,
+  ): void {
+    const state = this.memory.getState().getServerState(serverUrl);
+    const byIssuer = {
+      ...state.byIssuer,
+      [issuer]: { ...state.byIssuer?.[issuer], ...updates },
+    };
+    this.memory.getState().setServerState(serverUrl, {
+      byIssuer,
+      ...(setActive && { activeIssuer: issuer }),
+      ...clearLegacy,
+    });
+  }
+
+  /** Apply `fn` to every issuer slot (used by issuer-agnostic clears). */
+  private mapIssuerSlots(
+    state: ServerOAuthState,
+    fn: (slot: IssuerBoundOAuthState) => Partial<IssuerBoundOAuthState>,
+  ): Record<string, IssuerBoundOAuthState> {
+    const byIssuer: Record<string, IssuerBoundOAuthState> = {};
+    for (const [key, slot] of Object.entries(state.byIssuer ?? {})) {
+      byIssuer[key] = { ...slot, ...fn(slot) };
+    }
+    return byIssuer;
+  }
+
   async getClientInformation(
     serverUrl: string,
     isPreregistered?: boolean,
+    issuer?: string,
   ): Promise<OAuthClientInformation | undefined> {
     await this.ensureLoaded();
     const state = this.memory.getState().getServerState(serverUrl);
-    const clientInfo = isPreregistered
-      ? state.preregisteredClientInformation
-      : state.clientInformation;
 
+    if (isPreregistered) {
+      const prereg = state.preregisteredClientInformation;
+      return prereg
+        ? await OAuthClientInformationSchema.parseAsync(prereg)
+        : undefined;
+    }
+
+    // Per-issuer registration (SEP-2352), falling back to the legacy unkeyed slot.
+    const slot = this.issuerSlot(state, issuer);
+    const fromSlot = slot?.clientInformation;
+    const clientInfo = fromSlot ?? state.clientInformation;
     if (!clientInfo) {
       return undefined;
     }
-
-    return await OAuthClientInformationSchema.parseAsync(clientInfo);
+    const parsed = await OAuthClientInformationSchema.parseAsync(clientInfo);
+    // Stamp only when the value actually came from the issuer-keyed slot. Gating
+    // on `fromSlot` (not merely on the slot existing) keeps a legacy unkeyed
+    // credential — potentially minted by a *different* AS — from being stamped
+    // with this issuer, which would defeat the SDK's discardIfIssuerMismatch.
+    return withIssuer(
+      parsed,
+      fromSlot ? this.resolveReadIssuer(state, issuer) : undefined,
+    );
   }
 
   async getClientRegistrationKind(
     serverUrl: string,
+    issuer?: string,
   ): Promise<OAuthClientRegistrationKind | undefined> {
     await this.ensureLoaded();
-    return this.memory.getState().getServerState(serverUrl)
-      .clientRegistrationKind;
+    const state = this.memory.getState().getServerState(serverUrl);
+    return (
+      this.issuerSlot(state, issuer)?.clientRegistrationKind ??
+      state.clientRegistrationKind
+    );
   }
 
   async saveClientInformation(
@@ -97,10 +192,24 @@ export class OAuthStorageBase implements OAuthStorage {
     options: SaveClientInformationOptions,
   ): Promise<void> {
     await this.ensureLoaded();
-    this.memory.getState().setServerState(serverUrl, {
-      clientInformation,
-      clientRegistrationKind: options.registrationKind,
-    });
+    if (options.issuer !== undefined) {
+      this.updateIssuerSlot(
+        serverUrl,
+        options.issuer,
+        {
+          clientInformation,
+          clientRegistrationKind: options.registrationKind,
+        },
+        { clientInformation: undefined, clientRegistrationKind: undefined },
+      );
+    } else {
+      // No issuer yet (our own DCR/CIMD pre-registration callers): write the
+      // unkeyed slot; the SDK promotes it per-issuer on the next stamped save.
+      this.memory.getState().setServerState(serverUrl, {
+        clientInformation,
+        clientRegistrationKind: options.registrationKind,
+      });
+    }
     await this.persist();
   }
 
@@ -119,29 +228,61 @@ export class OAuthStorageBase implements OAuthStorage {
   async clearClientInformation(
     serverUrl: string,
     isPreregistered?: boolean,
+    issuer?: string,
   ): Promise<void> {
     await this.ensureLoaded();
-    const updates: Partial<ServerOAuthState> = {};
 
     if (isPreregistered) {
-      updates.preregisteredClientInformation = undefined;
-    } else {
-      updates.clientInformation = undefined;
-      updates.clientRegistrationKind = undefined;
+      this.memory.getState().setServerState(serverUrl, {
+        preregisteredClientInformation: undefined,
+      });
+      await this.persist();
+      return;
     }
 
-    this.memory.getState().setServerState(serverUrl, updates);
+    if (issuer !== undefined) {
+      this.updateIssuerSlot(
+        serverUrl,
+        issuer,
+        { clientInformation: undefined, clientRegistrationKind: undefined },
+        {},
+        false,
+      );
+    } else {
+      // Clear every issuer's registration plus the legacy unkeyed entry.
+      const state = this.memory.getState().getServerState(serverUrl);
+      const byIssuer = this.mapIssuerSlots(state, () => ({
+        clientInformation: undefined,
+        clientRegistrationKind: undefined,
+      }));
+      this.memory.getState().setServerState(serverUrl, {
+        byIssuer,
+        clientInformation: undefined,
+        clientRegistrationKind: undefined,
+      });
+    }
     await this.persist();
   }
 
-  async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
+  async getTokens(
+    serverUrl: string,
+    issuer?: string,
+  ): Promise<OAuthTokens | undefined> {
     await this.ensureLoaded();
     const state = this.memory.getState().getServerState(serverUrl);
-    if (!state.tokens) {
+    const slot = this.issuerSlot(state, issuer);
+    const fromSlot = slot?.tokens;
+    const tokens = fromSlot ?? state.tokens;
+    if (!tokens) {
       return undefined;
     }
-
-    return await OAuthTokensSchema.parseAsync(state.tokens);
+    const parsed = await OAuthTokensSchema.parseAsync(tokens);
+    // Stamp only when the value came from the issuer-keyed slot (see
+    // getClientInformation) — never stamp a legacy unkeyed token with this issuer.
+    return withIssuer(
+      parsed,
+      fromSlot ? this.resolveReadIssuer(state, issuer) : undefined,
+    );
   }
 
   async saveTokens(
@@ -150,16 +291,46 @@ export class OAuthStorageBase implements OAuthStorage {
     options?: SaveTokensOptions,
   ): Promise<void> {
     await this.ensureLoaded();
-    this.memory.getState().setServerState(serverUrl, {
-      tokens,
-      ...(options?.enterpriseManaged === true && { enterpriseManaged: true }),
-    });
+    if (options?.issuer !== undefined) {
+      this.updateIssuerSlot(
+        serverUrl,
+        options.issuer,
+        { tokens },
+        {
+          tokens: undefined,
+          ...(options.enterpriseManaged === true && {
+            enterpriseManaged: true,
+          }),
+        },
+      );
+    } else {
+      this.memory.getState().setServerState(serverUrl, {
+        tokens,
+        ...(options?.enterpriseManaged === true && { enterpriseManaged: true }),
+      });
+    }
     await this.persist();
   }
 
-  async clearTokens(serverUrl: string): Promise<void> {
+  async clearTokens(serverUrl: string, issuer?: string): Promise<void> {
     await this.ensureLoaded();
-    this.memory.getState().setServerState(serverUrl, { tokens: undefined });
+    if (issuer !== undefined) {
+      this.updateIssuerSlot(
+        serverUrl,
+        issuer,
+        { tokens: undefined },
+        {},
+        false,
+      );
+    } else {
+      const state = this.memory.getState().getServerState(serverUrl);
+      const byIssuer = this.mapIssuerSlots(state, () => ({
+        tokens: undefined,
+      }));
+      this.memory
+        .getState()
+        .setServerState(serverUrl, { byIssuer, tokens: undefined });
+    }
     await this.persist();
   }
 
@@ -229,6 +400,30 @@ export class OAuthStorageBase implements OAuthStorage {
     await this.persist();
   }
 
+  async getDiscoveryState(
+    serverUrl: string,
+  ): Promise<OAuthDiscoveryState | undefined> {
+    await this.ensureLoaded();
+    return this.memory.getState().getServerState(serverUrl).discoveryState;
+  }
+
+  async saveDiscoveryState(
+    serverUrl: string,
+    state: OAuthDiscoveryState,
+  ): Promise<void> {
+    await this.ensureLoaded();
+    this.memory.getState().setServerState(serverUrl, { discoveryState: state });
+    await this.persist();
+  }
+
+  async clearDiscoveryState(serverUrl: string): Promise<void> {
+    await this.ensureLoaded();
+    this.memory
+      .getState()
+      .setServerState(serverUrl, { discoveryState: undefined });
+    await this.persist();
+  }
+
   async clear(serverUrl: string): Promise<void> {
     await this.ensureLoaded();
     this.memory.getState().clearServerState(serverUrl);
diff --git a/core/auth/providers.ts b/core/auth/providers.ts
index 0ce422151..12808542c 100644
--- a/core/auth/providers.ts
+++ b/core/auth/providers.ts
@@ -7,6 +7,7 @@ import type {
   OAuthClientMetadata,
   OAuthTokens,
   OAuthMetadata,
+  OAuthDiscoveryState,
 } from "@modelcontextprotocol/client";
 import type { OAuthStorage, SaveClientInformationOptions } from "./storage.js";
 import { generateOAuthState } from "./utils.js";
@@ -178,6 +179,13 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
       client_name: "MCP Inspector",
       client_uri: "https://github.com/modelcontextprotocol/inspector",
       scope: this.scope ?? "",
+      // SEP-837: the Inspector is a locally-hosted app reached over localhost, so
+      // it registers as a native client. OIDC-flavored ASes default an omitted
+      // `application_type` to `"web"`, which forbids loopback redirect URIs and
+      // rejects DCR. (The SDK also infers `"native"` from loopback `redirect_uris`;
+      // declaring it explicitly keeps the value visible and correct even when the
+      // redirect host is not itself a loopback literal.)
+      application_type: "native",
     };
 
     // Note: clientMetadataUrl for CIMD mode is passed to registerClient() directly,
@@ -190,8 +198,11 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     return generateOAuthState();
   }
 
-  async clientInformation(): Promise<OAuthClientInformation | undefined> {
-    // Try preregistered first, then dynamically registered
+  async clientInformation(
+    ctx?: OAuthClientInformationContext,
+  ): Promise<OAuthClientInformation | undefined> {
+    // Try preregistered (static, issuer-independent) first, then the per-issuer
+    // dynamic registration (SEP-2352 — keyed by `ctx.issuer`).
     const preregistered = await this.storage.getClientInformation(
       this.serverUrl,
       true,
@@ -199,7 +210,11 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     if (preregistered) {
       return preregistered;
     }
-    return await this.storage.getClientInformation(this.serverUrl, false);
+    return await this.storage.getClientInformation(
+      this.serverUrl,
+      false,
+      ctx?.issuer,
+    );
   }
 
   async saveClientInformation(
@@ -207,19 +222,22 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     // SDK v2's `OAuthClientProvider.saveClientInformation` passes an
     // `OAuthClientInformationContext` ({ issuer }); our own DCR/CIMD callers
     // pass `SaveClientInformationOptions` ({ registrationKind }). Accept either
-    // and narrow on the discriminating key. Per-issuer keying (SEP-2352) is a
-    // later card — for now we only read the registration kind.
+    // and read whichever keys are present: the SDK supplies `issuer` (SEP-2352
+    // per-AS keying) and defaults registration kind to DCR; our callers supply
+    // the registration kind and no issuer yet.
     options?: SaveClientInformationOptions | OAuthClientInformationContext,
   ): Promise<void> {
     const registrationKind =
       options && "registrationKind" in options
         ? options.registrationKind
         : "dcr";
+    const issuer = options && "issuer" in options ? options.issuer : undefined;
     await this.storage.saveClientInformation(
       this.serverUrl,
       clientInformation,
       {
         registrationKind,
+        issuer,
       },
     );
   }
@@ -238,12 +256,19 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
     );
   }
 
-  async tokens(): Promise<OAuthTokens | undefined> {
-    return await this.storage.getTokens(this.serverUrl);
+  async tokens(
+    ctx?: OAuthClientInformationContext,
+  ): Promise<OAuthTokens | undefined> {
+    return await this.storage.getTokens(this.serverUrl, ctx?.issuer);
   }
 
-  async saveTokens(tokens: OAuthTokens): Promise<void> {
-    await this.storage.saveTokens(this.serverUrl, tokens);
+  async saveTokens(
+    tokens: OAuthTokens,
+    ctx?: OAuthClientInformationContext,
+  ): Promise<void> {
+    await this.storage.saveTokens(this.serverUrl, tokens, {
+      issuer: ctx?.issuer,
+    });
   }
 
   redirectToAuthorization(authorizationUrl: URL): void {
@@ -285,4 +310,47 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
   async saveServerMetadata(metadata: OAuthMetadata): Promise<void> {
     await this.storage.saveServerMetadata(this.serverUrl, metadata);
   }
+
+  /**
+   * SEP-2352 discovery-state round-trip. The SDK persists RFC 9728/8414 discovery
+   * here (alongside the code verifier) so that on the authorization-code callback
+   * leg it can compare the resolved AS `issuer` against the one recorded at
+   * redirect time and reject a mismatch (`AuthorizationServerMismatchError`).
+   * Without these two methods the SDK only `console.warn`s and the binding check
+   * is inactive.
+   */
+  async saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {
+    await this.storage.saveDiscoveryState(this.serverUrl, state);
+  }
+
+  async discoveryState(): Promise<OAuthDiscoveryState | undefined> {
+    return this.storage.getDiscoveryState(this.serverUrl);
+  }
+
+  /**
+   * SEP-2352 credential invalidation. The SDK calls this to drop credentials the
+   * server has rejected; hosts also call `'discovery'` on repeated 401s so a
+   * changed `authorization_servers` list is re-fetched.
+   */
+  async invalidateCredentials(
+    scope: "all" | "client" | "tokens" | "verifier" | "discovery",
+  ): Promise<void> {
+    switch (scope) {
+      case "all":
+        await this.storage.clear(this.serverUrl);
+        return;
+      case "client":
+        await this.storage.clearClientInformation(this.serverUrl);
+        return;
+      case "tokens":
+        await this.storage.clearTokens(this.serverUrl);
+        return;
+      case "verifier":
+        await this.storage.clearCodeVerifier(this.serverUrl);
+        return;
+      case "discovery":
+        await this.storage.clearDiscoveryState(this.serverUrl);
+        return;
+    }
+  }
 }
diff --git a/core/auth/storage.ts b/core/auth/storage.ts
index 1af4d61f1..90163c19d 100644
--- a/core/auth/storage.ts
+++ b/core/auth/storage.ts
@@ -2,6 +2,7 @@ import type {
   OAuthClientInformation,
   OAuthTokens,
   OAuthMetadata,
+  OAuthDiscoveryState,
 } from "@modelcontextprotocol/client";
 import type { OAuthClientRegistrationKind } from "./types.js";
 
@@ -12,12 +13,23 @@ import type { OAuthClientRegistrationKind } from "./types.js";
 export interface SaveTokensOptions {
   /** Marks resource tokens minted via EMA (legs 2–3) for sign-out cleanup. */
   enterpriseManaged?: boolean;
+  /**
+   * Authorization-server `issuer` these tokens are bound to (SEP-2352). When set,
+   * tokens are keyed under `(server, issuer)`; when omitted (EMA / legacy callers)
+   * they write the per-server fallback slot.
+   */
+  issuer?: string;
 }
 
 export type { OAuthClientRegistrationKind };
 
 export interface SaveClientInformationOptions {
   registrationKind: "dcr" | "cimd";
+  /**
+   * Authorization-server `issuer` this client registration is bound to (SEP-2352).
+   * Client identifiers are unique to the AS that issued them (RFC 6749 §2.2).
+   */
+  issuer?: string;
 }
 
 export interface OAuthStorage {
@@ -29,11 +41,16 @@ export interface OAuthStorage {
   load(): Promise<void>;
 
   /**
-   * Get client information (preregistered or dynamically registered)
+   * Get client information (preregistered or dynamically registered).
+   *
+   * @param issuer - When set, return the registration bound to this AS `issuer`
+   *   (SEP-2352). When omitted, return the active-issuer slot, falling back to
+   *   the legacy unkeyed entry.
    */
   getClientInformation(
     serverUrl: string,
     isPreregistered?: boolean,
+    issuer?: string,
   ): Promise<OAuthClientInformation | undefined>;
 
   /**
@@ -41,6 +58,7 @@ export interface OAuthStorage {
    */
   getClientRegistrationKind(
     serverUrl: string,
+    issuer?: string,
   ): Promise<OAuthClientRegistrationKind | undefined>;
 
   /**
@@ -61,17 +79,25 @@ export interface OAuthStorage {
   ): Promise<void>;
 
   /**
-   * Clear client information
+   * Clear client information. When `issuer` is set, clear only that AS's
+   * registration; when omitted, clear every issuer's registration plus the
+   * legacy unkeyed entry.
    */
   clearClientInformation(
     serverUrl: string,
     isPreregistered?: boolean,
+    issuer?: string,
   ): Promise<void>;
 
   /**
-   * Get OAuth tokens
+   * Get OAuth tokens. When `issuer` is set, return that AS's tokens (SEP-2352);
+   * when omitted, return the active-issuer tokens, falling back to the legacy
+   * unkeyed entry (the transport's per-request bearer read).
    */
-  getTokens(serverUrl: string): Promise<OAuthTokens | undefined>;
+  getTokens(
+    serverUrl: string,
+    issuer?: string,
+  ): Promise<OAuthTokens | undefined>;
 
   /**
    * Save OAuth tokens
@@ -83,9 +109,10 @@ export interface OAuthStorage {
   ): Promise<void>;
 
   /**
-   * Clear OAuth tokens
+   * Clear OAuth tokens. When `issuer` is set, clear only that AS's tokens; when
+   * omitted, clear every issuer's tokens plus the legacy unkeyed entry.
    */
-  clearTokens(serverUrl: string): Promise<void>;
+  clearTokens(serverUrl: string, issuer?: string): Promise<void>;
 
   /**
    * Get code verifier (for PKCE)
@@ -132,6 +159,29 @@ export interface OAuthStorage {
    */
   clearServerMetadata(serverUrl: string): Promise<void>;
 
+  /**
+   * Get the cached RFC 9728/8414 discovery state (SEP-2352). The SDK restores it
+   * to skip re-discovery and, on the authorization-code callback leg, to bind the
+   * exchange to the AS that minted the code (`AuthorizationServerMismatchError`).
+   */
+  getDiscoveryState(
+    serverUrl: string,
+  ): Promise<OAuthDiscoveryState | undefined>;
+
+  /**
+   * Save the RFC 9728/8414 discovery state. Persisted alongside the code verifier
+   * so it survives the authorization redirect round-trip.
+   */
+  saveDiscoveryState(
+    serverUrl: string,
+    state: OAuthDiscoveryState,
+  ): Promise<void>;
+
+  /**
+   * Clear the cached discovery state (SDK `invalidateCredentials('discovery')`).
+   */
+  clearDiscoveryState(serverUrl: string): Promise<void>;
+
   /**
    * Clear all OAuth data for a server
    */
diff --git a/core/auth/store.ts b/core/auth/store.ts
index ba72ff6fc..d5e135118 100644
--- a/core/auth/store.ts
+++ b/core/auth/store.ts
@@ -7,6 +7,7 @@ import type {
   OAuthClientInformation,
   OAuthTokens,
   OAuthMetadata,
+  OAuthDiscoveryState,
 } from "@modelcontextprotocol/client";
 import type {
   IdpSessionState,
@@ -15,19 +16,57 @@ import type {
 import type { OAuthPersistSnapshot } from "./oauth-persist.js";
 
 /**
- * OAuth state for a single server
+ * OAuth credentials bound to a single authorization-server `issuer` (SEP-2352).
+ *
+ * Client identifiers are unique to the AS that issued them (RFC 6749 §2.2), and
+ * tokens minted by one AS must never be presented to another. The SDK v2 stamps
+ * `issuer` on the objects it saves and passes `ctx.issuer` on every read/write;
+ * this record is how the Inspector keys that state per authorization server so a
+ * resource that migrates between ASes re-registers/re-authorizes cleanly instead
+ * of reusing mismatched credentials.
  */
-export interface ServerOAuthState {
+export interface IssuerBoundOAuthState {
   clientInformation?: OAuthClientInformation;
   /** Set when {@link clientInformation} is saved — DCR vs CIMD. */
   clientRegistrationKind?: OAuthClientRegistrationKind;
-  preregisteredClientInformation?: OAuthClientInformation;
   tokens?: OAuthTokens;
+}
+
+/**
+ * OAuth state for a single server.
+ *
+ * Issuer-bound credentials (client info + tokens) live under {@link byIssuer},
+ * keyed by AS `issuer` (SEP-2352). Per-server / per-flow state (code verifier,
+ * discovered metadata, discovery state, static client info, EMA marker, and the
+ * requested-scope seed) is issuer-independent and stays at the top level.
+ *
+ * The bare top-level {@link clientInformation} / {@link tokens} fields are the
+ * **legacy unkeyed fallback**: a pre-1625 snapshot deserializes with credentials
+ * here and no `issuer` stamp. Reads fall back to them when {@link byIssuer} has
+ * no entry; the first issuer-stamped save promotes them into {@link byIssuer} and
+ * clears the fallback (lazy migration — see `OAuthStorageBase`). New saves never
+ * write the bare fields.
+ */
+export interface ServerOAuthState {
+  /** Per-issuer credentials (SEP-2352). */
+  byIssuer?: Record<string, IssuerBoundOAuthState>;
+  /** Most-recently-saved issuer — answers ctx-less reads (per-request bearer token). */
+  activeIssuer?: string;
+  preregisteredClientInformation?: OAuthClientInformation;
   codeVerifier?: string;
   scope?: string;
   serverMetadata?: OAuthMetadata;
+  /** RFC 9728/8414 discovery cache; persisted alongside {@link codeVerifier} (SEP-2352 callback-leg binding). */
+  discoveryState?: OAuthDiscoveryState;
   /** Set when resource tokens were minted via EMA (legs 2–3). */
   enterpriseManaged?: boolean;
+
+  /** @deprecated Legacy unkeyed fallback — see {@link ServerOAuthState}. */
+  clientInformation?: OAuthClientInformation;
+  /** @deprecated Legacy unkeyed fallback — see {@link ServerOAuthState}. */
+  clientRegistrationKind?: OAuthClientRegistrationKind;
+  /** @deprecated Legacy unkeyed fallback — see {@link ServerOAuthState}. */
+  tokens?: OAuthTokens;
 }
 
 /**
diff --git a/core/auth/types.ts b/core/auth/types.ts
index 82b0bfb42..b21d7cf1a 100644
--- a/core/auth/types.ts
+++ b/core/auth/types.ts
@@ -6,12 +6,21 @@ import type {
   OAuthProtectedResourceMetadata,
 } from "@modelcontextprotocol/client";
 
-// OAuth flow steps
+// OAuth flow steps. Extended for the 2026-07-28 authorization hardening:
+// `cimd_fetch` (SEP-991 client-id metadata document registration), `issuer_comparison`
+// (SEP-2352 authorization-server binding check), and `scope_step_up` (SEP-2350
+// accumulated-scope re-authorization).
 export type OAuthStep =
   | "metadata_discovery"
   | "client_registration"
+  /** SEP-991 — registering via a Client ID Metadata Document instead of DCR. */
+  | "cimd_fetch"
+  /** SEP-2352 — comparing the resolved AS `issuer` against stored/discovered state. */
+  | "issuer_comparison"
   | "authorization_redirect"
   | "authorization_code"
+  /** SEP-2350 — re-authorizing with the accumulated (prior ∪ challenged) scope union. */
+  | "scope_step_up"
   | "token_request"
   | "complete";
 
diff --git a/core/mcp/node/transport.ts b/core/mcp/node/transport.ts
index 971bf9e29..ba943da36 100644
--- a/core/mcp/node/transport.ts
+++ b/core/mcp/node/transport.ts
@@ -211,6 +211,11 @@ export function createTransportNode(
       authProvider,
       requestInit,
       fetch: transportFetch,
+      // SEP-2350: how the transport reacts to a `403 insufficient_scope`
+      // challenge. Defaults to the SDK's `reauthorize` when unset.
+      ...(settings?.oauthOnInsufficientScope && {
+        onInsufficientScope: settings.oauthOnInsufficientScope,
+      }),
     });
 
     return { transport };
diff --git a/core/mcp/oauthManager.ts b/core/mcp/oauthManager.ts
index 4297f70c0..3decd17fd 100644
--- a/core/mcp/oauthManager.ts
+++ b/core/mcp/oauthManager.ts
@@ -771,7 +771,14 @@ export class OAuthManager {
     }
 
     const clientInfo = await provider.clientInformation();
-    await this.recordAuthorizationCodeFlowState(capturedUrl, clientInfo);
+    await this.recordAuthorizationCodeFlowState(
+      capturedUrl,
+      clientInfo,
+      // SEP-2350: label a step-up redirect distinctly from a first-time login.
+      enriched.reason === "insufficient_scope"
+        ? "scope_step_up"
+        : "authorization_code",
+    );
 
     return {
       kind: "interactive",
@@ -810,10 +817,11 @@ export class OAuthManager {
   private async recordAuthorizationCodeFlowState(
     authorizationUrl: URL,
     oauthClientInfo?: OAuthClientInformation | null,
+    step: OAuthStep = "authorization_code",
   ): Promise<void> {
     this.oauthFlowState = {
       ...EMPTY_OAUTH_FLOW_STATE,
-      oauthStep: "authorization_code",
+      oauthStep: step,
       authorizationUrl,
       oauthClientInfo: oauthClientInfo ?? null,
     };
diff --git a/core/mcp/remote/node/server.ts b/core/mcp/remote/node/server.ts
index 719719306..6829a9897 100644
--- a/core/mcp/remote/node/server.ts
+++ b/core/mcp/remote/node/server.ts
@@ -1415,6 +1415,17 @@ export function createRemoteApp(
         error: "settings.enterpriseManaged must be a boolean",
       };
     }
+    if (
+      obj.oauthOnInsufficientScope !== undefined &&
+      obj.oauthOnInsufficientScope !== "reauthorize" &&
+      obj.oauthOnInsufficientScope !== "throw"
+    ) {
+      return {
+        ok: false,
+        error:
+          "settings.oauthOnInsufficientScope must be 'reauthorize' or 'throw'",
+      };
+    }
     // roots is optional on the wire (older clients won't send it); when
     // present it must be an array of `{ uri, name? }`. Reuses the same
     // module-scope `isRootArray` guard the read path applies in
@@ -1477,6 +1488,12 @@ export function createRemoteApp(
     if (obj.enterpriseManaged === true) {
       value.enterpriseManaged = true;
     }
+    if (
+      obj.oauthOnInsufficientScope === "reauthorize" ||
+      obj.oauthOnInsufficientScope === "throw"
+    ) {
+      value.oauthOnInsufficientScope = obj.oauthOnInsufficientScope;
+    }
     // Empty cwd coerces to absent on the value (matching the read side); the
     // write-through distinguishes "sent cwd: '' " (clear) from "cwd omitted"
     // (preserve) via `cwdProvided` below rather than the value alone.
diff --git a/core/mcp/serverList.ts b/core/mcp/serverList.ts
index becedb131..4e9b4dd67 100644
--- a/core/mcp/serverList.ts
+++ b/core/mcp/serverList.ts
@@ -197,6 +197,9 @@ export function storedFieldsToInspectorSettings(
   if (stored.oauth?.clientSecret)
     settings.oauthClientSecret = stored.oauth.clientSecret;
   if (stored.oauth?.scopes) settings.oauthScopes = stored.oauth.scopes;
+  if (stored.oauth?.onInsufficientScope) {
+    settings.oauthOnInsufficientScope = stored.oauth.onInsufficientScope;
+  }
   if (stored.oauth?.enterpriseManaged === true) {
     settings.enterpriseManaged = true;
   }
@@ -263,16 +266,14 @@ export function inspectorSettingsToStoredFields(
     out.maxFetchRequests = settings.maxFetchRequests;
   }
 
-  const oauthFields: {
-    clientId?: string;
-    clientSecret?: string;
-    scopes?: string;
-    enterpriseManaged?: boolean;
-  } = {};
+  const oauthFields: NonNullable<StoredMCPServer["oauth"]> = {};
   if (settings.oauthClientId) oauthFields.clientId = settings.oauthClientId;
   if (settings.oauthClientSecret)
     oauthFields.clientSecret = settings.oauthClientSecret;
   if (settings.oauthScopes) oauthFields.scopes = settings.oauthScopes;
+  if (settings.oauthOnInsufficientScope) {
+    oauthFields.onInsufficientScope = settings.oauthOnInsufficientScope;
+  }
   if (settings.enterpriseManaged === true) {
     oauthFields.enterpriseManaged = true;
   }
diff --git a/core/mcp/types.ts b/core/mcp/types.ts
index 192785417..4d024be72 100644
--- a/core/mcp/types.ts
+++ b/core/mcp/types.ts
@@ -134,6 +134,8 @@ export type StoredMCPServer = MCPServerConfig & {
     scopes?: string;
     /** When true, connect via enterprise IdP (EMA) instead of standard resource OAuth. */
     enterpriseManaged?: boolean;
+    /** SEP-2350 step-up policy for `403 insufficient_scope` (default `reauthorize`). */
+    onInsufficientScope?: OnInsufficientScopePolicy;
   };
   /**
    * Filesystem/URI roots advertised to the server via the `roots` client
@@ -406,8 +408,17 @@ export interface OAuthSettings {
   clientSecret: string;
   scopes: string;
   enterpriseManaged?: boolean;
+  onInsufficientScope?: OnInsufficientScopePolicy;
 }
 
+/**
+ * SEP-2350 step-up policy for a `403 insufficient_scope` challenge. `reauthorize`
+ * (the SDK default) drives step-up authorization with the accumulated scope union;
+ * `throw` surfaces the challenge to the host instead. Forwarded to the
+ * StreamableHTTP transport's `onInsufficientScope` option.
+ */
+export type OnInsufficientScopePolicy = "reauthorize" | "throw";
+
 /**
  * Default TTL (ms) for tasks created via "Run as task". Mirrors v1/v1.5's
  * `MCP_TASK_TTL` config default. Used when a server has no explicit `taskTtl`.
@@ -454,6 +465,11 @@ export interface InspectorServerSettings {
   oauthClientId?: string;
   oauthClientSecret?: string;
   oauthScopes?: string;
+  /**
+   * SEP-2350 step-up policy for a `403 insufficient_scope` challenge on this
+   * server's HTTP transport. Defaults to `reauthorize` when unset.
+   */
+  oauthOnInsufficientScope?: OnInsufficientScopePolicy;
   /**
    * When true, connect via the configured enterprise IdP (EMA) instead of
    * interactive OAuth to the MCP authorization server. Per-server OAuth
diff --git a/specification/v2_auth_hardening.md b/specification/v2_auth_hardening.md
index 1affdfc4e..69503bf99 100644
--- a/specification/v2_auth_hardening.md
+++ b/specification/v2_auth_hardening.md
@@ -11,6 +11,17 @@ The [2026-07-28 release candidate](https://blog.modelcontextprotocol.io/posts/20
 
 **Strategy:** Upgrade to the v2 TypeScript SDK (`@modelcontextprotocol/client`) when its auth-hardening PRs land. Do **not** reimplement SDK OAuth logic in Inspector — delegate connect-time standard OAuth to the SDK and wire the gaps (callback parameters, storage shape, client type). **Mid-session authorization** is a separate, near-term track ([Mid-session auth](v2_auth_mid_session.md)); this doc covers connect-time and storage hardening that mid-session builds on.
 
+## Implementation status (#1625, on `@modelcontextprotocol/client` 2.0.0-beta.4)
+
+The SDK upgrade ([#1624](https://github.com/modelcontextprotocol/inspector/issues/1624)) and RFC 9207 `iss` forwarding ([#1687](https://github.com/modelcontextprotocol/inspector/pull/1687)) landed first. This section records the **as-built** behavior of the storage re-key + SEP-837/2350/2352 UX ([#1625](https://github.com/modelcontextprotocol/inspector/issues/1625)); it supersedes the forward-looking prose below where they differ.
+
+- **SEP-2352 — issuer-bound credentials (done).** `ServerOAuthState` now nests issuer-bound credentials under `byIssuer[issuer] = { clientInformation, clientRegistrationKind, tokens }`, with an `activeIssuer` pointer answering the transport's ctx-less per-request bearer read. The SDK v2 `auth()` drives the whole flow — it builds `infoCtx = { issuer }`, stamps `issuer` on everything it saves, and calls `discardIfIssuerMismatch` on reads — so the Inspector's job is to **honor `ctx.issuer`** and **round-trip the stamp**. A latent bug was that `OAuthStorageBase` re-parsed tokens/client-info through `OAuthTokensSchema`/`OAuthClientInformationSchema`, which **strip** the non-RFC `issuer` field; the store now re-attaches it from the `byIssuer` key. `BaseOAuthClientProvider` implements `discoveryState()`/`saveDiscoveryState()` (activating the SDK's callback-leg `AuthorizationServerMismatchError` binding check) and `invalidateCredentials(scope)`. Migration is **lazy**: a legacy pre-1625 blob's top-level `clientInformation`/`tokens` are returned as an unkeyed fallback until the first issuer-stamped save promotes them into `byIssuer` — existing web/TUI/CLI sessions survive the upgrade.
+- **SEP-837 — `application_type` (done).** The shared `BaseOAuthClientProvider` declares `application_type: "native"` for **all** environments: the Inspector is a locally-hosted app reached over `localhost`, so it is a native client per RFC 8252 (the SDK also infers `"native"` from loopback `redirect_uris`). This supersedes the "web = `web`" split in the per-SEP table below. `ClientSettingsForm` renders DCR `RegistrationRejectedError` details and reflects DCR's deprecated-in-favor-of-CIMD (SEP-991) status.
+- **SEP-2350 — step-up union (done).** The scope-union machinery (`core/auth/scopes.ts`, `handleAuthChallenge`) predates this card; #1625 adds the UX: a **per-server** `onInsufficientScope` (`reauthorize | throw`) setting (`ServerSettingsForm` → `StoredMCPServer.oauth` → `StreamableHTTPClientTransport`), and a scope-union visualization in `StepUpAuthModal` that tags each union scope `new` vs `already granted`.
+- **`mcpAuth` (simplified, not deleted).** `core/auth/mcpAuth.ts` is now a thin forwarder to SDK `auth()` — the hand-rolled `authorizeWithoutRefresh` (which mishandled issuer stamping) was deleted and `forceReauthorization`/`skipIssuerMetadataValidation` are forwarded natively, so both the initial and step-up paths get SEP-2352 stamping. `core/auth/scopes.ts` is **retained** (still the union source; the SDK's `computeScopeUnion` export is a future cleanup).
+- **Vocabulary.** `OAuthStep` gains `cimd_fetch` / `issuer_comparison` / `scope_step_up` (the manager records `scope_step_up` on a step-up redirect), and the Network tab labels `auth`-category requests by OAuth phase (Discovery / Registration / Authorize / Token).
+- **Deferred to the era-aware card.** The `SdkError(EraNegotiationFailed) → UnauthorizedError` unwrap and the `finishAuth(URLSearchParams)` whole-params form only fire under `auto`/`pin` negotiation; the Inspector is pinned to `versionNegotiation: 'legacy'`, so this lands with the era-aware connection model.
+
 ## Normative references
 
 - [MCP authorization (draft — 2026-07-28 RC target)](https://modelcontextprotocol.io/specification/draft/basic/authorization)