Run each MCP server in its own container with per-tool scopes to cap blast radius

Stacklok·medium signalXBlueskyLinkedInCopy link

The single highest-value MCP isolation move in 2026 is giving each server its own container with minimal permissions, so a compromise can't touch the host filesystem, reach other servers, or escalate. Layer on per-tool OAuth scopes — declare and enforce granular permissions like calendar:read, email:send, contacts:delete on every request rather than a single broad grant — so an injection-driven tool call can only do what that specific tool was scoped for. The 2026 spec also makes Protected Resource Metadata and PKCE mandatory and separates the resource server from the authorization server (your MCP server validates tokens, it doesn't issue them).