Request per-operation MCP scopes with the 2026 incremental-scope-consent spec
Practical DevSecOps·medium signal
The 2026 MCP specification update adds incremental scope consent, letting clients request only the minimum access needed for each operation rather than granting a broad standing scope at connect time. This shrinks the blast radius when a tool or server is compromised. Actionable: adopt clients that support incremental consent and design your own MCP servers to declare granular per-operation scopes instead of one all-encompassing permission grant.