Dialing in scopes for MCP sign-ins

Speakeasy has introduced MCP sign-in scope selection that prioritizes permissions requested or advertised by an MCP server, aiming to avoid both insufficient access and overly broad OAuth consent requests. Servers can identify needed scopes through OAuth bearer-token challenges or protected resource metadata, although metadata must match the server URL exactly, including trailing slashes. Scope selection follows a six-level precedence order beginning with client overrides and server challenge scopes, followed by pinned server scopes, advertised server scopes, provider overrides, and finally the identity provider’s full scope catalog; standard OpenID-related scopes are generally added when supported. Administrators can inspect the source and requested scopes in MCP server identity settings, pin scopes when server requests are unsuitable or absent, or allow an identity provider to apply its defaults. Existing connections remain unchanged until their next sign-in, when they request the newly determined scope set.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.