@@ -47,9 +47,9 @@ pass an `MCP::Client::OAuth::Provider` to the transport instead of a static `Aut
 - On a `403 Forbidden` whose `WWW-Authenticate` header carries `error="insufficient_scope"` (OAuth 2.0 step-up, RFC 6750 Section 3.1 and the MCP scope-selection-strategy),
   run a fresh authorization request for the union of the currently granted scope and the scope named in the challenge, then retry the failed request once.
   The refresh path is bypassed because refreshing would re-issue the same scope set the server just rejected. A `403` without that challenge is surfaced unchanged.
-- By default, request `offline_access` when the client declares the `refresh_token` grant and the authorization server advertises it in
-  `scopes_supported` (SEP-2207). This can enable refresh tokens. The optional `scope_selector` below can remove it, while a selector
-  cannot reintroduce `offline_access` when the authorization server does not advertise it.
+- Request `offline_access` when the client declares the `refresh_token` grant and the authorization server advertises it in
+  `scopes_supported` (SEP-2207). The PRM scope selector below runs before this augmentation and cannot disable it.
+  Unsupported `offline_access` is stripped from every scope source.
 
 ```ruby
 require "mcp"
@@ -100,14 +100,19 @@ Optional keyword arguments:
 - `pending_authorization_max_age`: Integer seconds a pending authorization stays redeemable, counted from the moment `run!` saves it, when `callback_handler`
   is omitted. Defaults to 600.
 - `scope`: Space-separated fallback scopes when neither a challenge nor PRM advertises scopes.
-- `scope_selector`: Optional callable invoked after the SDK chooses scopes from the challenge, PRM, or `scope` fallback and augments
-  `offline_access`, but before request validation and client registration. It receives a read-only array of candidate scope tokens;
-  return an array of valid OAuth scope tokens to replace them, or `nil` / `[]` to omit the authorization URL's `scope` parameter.
-  The default (`nil`) keeps the MCP scope-selection strategy unchanged. A selector can narrow or add custom scopes, but cannot
-  reintroduce unsupported `offline_access`. Filtering a challenged scope may leave the current operation unauthorized.
-  Return `[]` to omit the client's `scope` parameter on the first request, even if PRM advertises scopes. The AS can still apply
-  default scopes or reject the request ([RFC 6749 §3.3](https://www.rfc-editor.org/rfc/rfc6749#section-3.3)); check the granted
-  scope before treating the connection as unscoped, and allow later challenged scopes when needed.
+- `scope_selector`: Optional callable for narrowing Protected Resource Metadata (PRM) defaults in the authorization-code flow.
+  It is invoked only when no nonempty challenged scope was supplied and PRM supplies the default `scopes_supported` list,
+  before `offline_access` augmentation, request validation, and client registration. It receives a read-only array of PRM tokens
+  and must return an array containing a subset; custom scopes and `nil` results raise `ArgumentError`. Return `[]` to request
+  none of those PRM defaults. Challenged scopes, including the step-up union, and provider fallback bypass the selector;
+  use `authorization_request_validator` to accept or refuse challenged scopes. With no selector, default behavior is unchanged.
+  This hook does not control `offline_access` augmentation or alter authorization-endpoint query parameters. Returning `[]`
+  does not guarantee an omitted `scope` parameter: refresh policy can add `offline_access`, and a prefilled endpoint scope
+  survives when the flow has no scope of its own. The AS can also apply defaults or reject the request
+  ([RFC 6749 §3.3](https://www.rfc-editor.org/rfc/rfc6749#section-3.3)); inspect the granted scopes.
+  For example, with PRM defaults `mcp:read mcp:write`, `scope_selector: ->(scopes) { scopes & ["mcp:read"] }` narrows the
+  default request to `mcp:read`; `scope_selector: ->(_scopes) { [] }` requests no PRM defaults. If the AS supports
+  `offline_access` and the client declares `refresh_token`, either request still includes `offline_access` afterward.
 - `authorization_request_validator`: Callable invoked with an `MCP::Client::OAuth::AuthorizationRequest` before any authorization request is built.
   Returning a falsy value abandons the flow with `Flow::AuthorizationRefusedError`. See [Reviewing the authorization request](#reviewing-the-authorization-request).
 - `http_client_customizer`: Callable invoked with the Faraday connection the SDK builds for the OAuth flow's own requests, after its defaults and before its origin guard.
 
@@ -267,9 +267,8 @@ def run!(server_url:, resource_metadata_url: nil, scope: nil)
 
           ensure_pkce_supported!(as_metadata)
 
-          effective_scope = resolve_scope(scope: scope, prm: prm)
+          effective_scope = resolve_scope(scope: scope, prm: prm, select_prm_scope: true)
           effective_scope = normalize_offline_access_scope(effective_scope, as_metadata: as_metadata)
-          effective_scope = select_scope(effective_scope, as_metadata: as_metadata)
 
           # Asked before registering, not after: a refusal must not leave this client registered at an authorization server
           # the embedding application has just rejected.
@@ -861,9 +860,8 @@ def ensure_same_origin!(url, label:, server_url:)
         # places on MCP servers rather than on clients.
         # A host that knows which providers its user deals with can apply that knowledge here.
         #
-        # By default, challenged scopes pass through unchanged. An explicit scope selector may narrow
-        # them, accepting that the current operation could remain unauthorized. The validator sees the
-        # final selection and can still refuse the authorization before client registration.
+        # Challenged scopes are authoritative for the operation and bypass the PRM scope selector.
+        # The validator can accept or refuse them, not quietly request fewer scopes.
         #
         # Only asked when a new grant is being requested. A refresh is not a new grant, and the host already answered
         # this question for that authorization server, so `refresh!` enforces `ensure_token_issuer!` instead:
@@ -1307,13 +1305,17 @@ def authorization_response_error(error, description)
         end
 
         # MCP scope selection prefers the challenge, then PRM `scopes_supported`, then the provider's fallback.
-        # A provider's optional selector can adjust the result after `offline_access` augmentation.
-        def resolve_scope(scope:, prm:)
+        # Authorization-code clients may narrow only the PRM default, before `offline_access` augmentation.
+        def resolve_scope(scope:, prm:, select_prm_scope: false)
           return scope if scope && !scope.empty?
 
           # `prm` is nil on the legacy path, where nothing advertises scopes.
           supported = prm && prm["scopes_supported"]
-          return supported.join(" ") if supported.is_a?(Array) && !supported.empty?
+          if supported.is_a?(Array) && !supported.empty?
+            return select_prm_scopes(supported) if select_prm_scope
+
+            return supported.join(" ")
+          end
 
           return @provider.scope if @provider.scope && !@provider.scope.empty?
 
@@ -1355,23 +1357,20 @@ def server_supports_offline_access?(as_metadata)
           supported.is_a?(Array) && supported.include?("offline_access")
         end
 
-        # Applies application policy after standard scope selection but before validation or registration.
-        def select_scope(scope, as_metadata:)
+        # Selects a subset of the PRM default without changing challenges, provider fallback, or refresh policy.
+        def select_prm_scopes(scopes)
           selector = @provider.scope_selector if @provider.respond_to?(:scope_selector)
-          return scope unless selector
+          return scopes.join(" ") unless selector
 
-          selected = selector.call(scope.to_s.split.freeze)
-          valid = selected.is_a?(Array) &&
-            selected.all? { |token| token.is_a?(String) && SCOPE_TOKEN_FORMAT.match?(token) }
-          unless selected.nil? || valid
-            raise ArgumentError, "scope_selector must return nil or an Array of valid OAuth scope tokens."
+          candidates = scopes.map { |token| token.dup.freeze }.freeze
+          selected = selector.call(candidates)
+          valid = selected.is_a?(Array) && selected.all? do |token|
+            token.is_a?(String) && SCOPE_TOKEN_FORMAT.match?(token) && candidates.include?(token)
           end
-          return if selected.nil?
-
-          # Custom scopes are allowed, but unsupported offline_access remains refused.
-          unless server_supports_offline_access?(as_metadata)
-            selected = selected.reject { |token| token == "offline_access" }
+          unless valid
+            raise ArgumentError, "scope_selector must return an Array containing only scopes from PRM scopes_supported."
           end
+
           selected.empty? ? nil : selected.join(" ")
         end
 
@@ -1437,9 +1436,8 @@ def build_authorization_url(as_metadata:, client_id:, scope:, state:, code_chall
           # RFC 6749 Section 3.1 forbids sending a parameter twice, and which of two values a server would honor is
           # its own choice; on the legacy path the endpoint URL is served by the MCP server, whose query must not speak
           # for the client's `client_id`, `redirect_uri`, `code_challenge`, or `resource`.
-          # Other endpoint parameters are kept, as the TypeScript SDK's `searchParams.set` keeps them.
-          # Without a selector, an endpoint `scope` survives when the flow has none: the AS may set a default there.
-          # A configured selector owns `scope` even when omitting it, so the endpoint query cannot override policy.
+          # Other parameters in the URL are kept, as the TypeScript SDK's `searchParams.set` keeps them; that includes
+          # a `scope` when the flow has none, since an authorization server may set a default scope there.
           # RFC 9101 `request` and `request_uri` are dropped as well, though the flow sets neither: a server takes
           # the whole authorization request from the object they carry, over every parameter in the query, and both are
           # the client's to send, never an endpoint URL's to supply.
@@ -1454,7 +1452,6 @@ def build_authorization_url(as_metadata:, client_id:, scope:, state:, code_chall
           own_params << ["scope", scope] if scope
           own_params << ["resource", resource] if resource
           dropped_names = own_params.map(&:first) + ["request", "request_uri"]
-          dropped_names << "scope" if @provider.respond_to?(:scope_selector) && @provider.scope_selector
 
           params = URI.decode_www_form(uri.query.to_s).reject { |name, _value| dropped_names.include?(name) }
           uri.query = URI.encode_www_form(params + own_params)
 
@@ -37,11 +37,10 @@ module OAuth
       #   `run!` saves it, when `callback_handler` is omitted. Defaults to `DEFAULT_PENDING_AUTHORIZATION_MAX_AGE`.
       # - `scope`   - String of space-separated scopes to request when the server's
       #   `WWW-Authenticate` does not specify one.
-      # - `scope_selector` - Callable receiving a read-only Array of candidate scope tokens after
-      #   challenge/PRM/provider selection and `offline_access` augmentation. Return an Array of valid
-      #   scope tokens to replace them, or `nil` / `[]` to omit the URL's `scope` parameter. The AS may
-      #   still apply default scopes. Unsupported `offline_access` remains stripped; filtering challenged
-      #   scopes may leave the operation unauthorized.
+      # - `scope_selector` - Callable receiving a read-only Array of PRM `scopes_supported` tokens when
+      #   those defaults are selected without a challenged scope. Return an Array containing a subset;
+      #   `[]` requests none of the PRM defaults. Challenged scopes and provider fallback bypass it.
+      #   The existing `offline_access` policy runs afterward; endpoint query parameters are unchanged.
       # - `storage` - Object responding to `tokens`, `save_tokens(tokens)`,
       #   `client_information`, and `save_client_information(info)`. Defaults to
       #   an `InMemoryStorage`. Persisted `client_information` is stamped with