Cloudflare made OAuth scopes optional for its MCP server, and the MCP roadmap admits the consent screen was built for somebody who is not there

Run wrangler login this morning and the consent dialog has a control in it that was not there last week. You can edit the permissions before you grant them. Cloudflare’s changelog entry for 22 August 2026 puts it in two sentences: “Wrangler and the Cloudflare API MCP server now use optional OAuth scopes. During authorization, you can choose which optional scopes to grant instead of approving every scope requested by each client” [1]. Required scopes stay ticked. Everything else you can refuse, and reauthorise later if a tool turns out to want it.

Two days before that, on 20 August, the platform half went generally available. Cloudflare’s wording is that “OAuth clients can now mark configured scopes as optional, allowing applications to request them without requiring users to approve them”, with Read Only and Full Access templates and a search box on the consent screen [2]. So the permission model landed on the Thursday and Cloudflare’s own agent-facing tooling took it up on the Saturday.

I have spent a fortnight reading about agent identity in alliances, foundations and working groups. The first piece of it that reached my terminal is a tick box in a login dialog.

The people who write the protocol say it in colder language

The Model Context Protocol roadmap was last updated on 22 August 2026, the same day as the Wrangler entry. Under the priority area named Agent Identity and Enterprise-Ready Security, the maintainers write the problem down without decoration: “MCP authorization assumes a person with a browser at consent time. Increasingly the caller is an agent: a cloud workload with its own identity, acting for a user who isn’t present, or spawning sub-agents that should get narrower authority than their parent” [3].

The next sentence is the one somebody will read out in a post-incident review. “Existing MCP servers lean on pasted API keys and long-lived refresh tokens” [3].

The named deliverables for this period are DPoP, which the roadmap wants finalised and widely adopted, and agent identity and delegation, built on Workload Identity Federation (SEP-1933), the Identity Assertion JWT Authorization Grant used by Enterprise-Managed Authorization, and RFC 8693 token exchange, coordinated with the IETF OAuth and WIMSE working groups [3]. Also under discussion, and my favourite line on the page, is “human-presence attestation for distinguishing interactive clients from headless agents” [3].

Read the governance carefully, though. The Agent Identity Working Group is described on the same page as “forming during this roadmap period” [3], and the page opens by saying it “reflects current thinking rather than firm commitments” [3]. The roadmap splits its own work honestly. DPoP needs finalising and adopting, which is a known quantity. Agent identity and delegation needs a group that does not have its members yet.

The callers are already there

PYMNTS reported on 24 August 2026 that AI agents are now the fastest-growing class of consumer for financial APIs, calling for those APIs without a human in the loop, and that pricing, identity and trust are being rebuilt around machine-speed callers rather than people [4]. It quotes Ramesh Raskar of the MIT Media Lab saying “Right now, we are in the mainframe era of AI. We are moving to the PC era of AI, and that changes everything”, and David Parker of Accenture with the line the banks will end up putting on a slide, “Trust is no longer a byproduct of good service. It is the product” [4].

The underlying research is older than the coverage and worth naming as such. The World Economic Forum published The AI Playbook for Financial Services with Accenture in June 2026, drawing on eighteen months of roundtables and interviews with more than 150 senior leaders across over 100 organisations, held in Hong Kong, London, New York and Singapore [5]. The spending behind it is committed rather than projected. Lloyds Banking Group said in January that it expects more than £100 million in value from generative and agentic AI in 2026, after around £50 million in 2025 [6].

Somebody at that bank is going to connect an agent to a payments API this autumn. The standard that governs how it proves who it is has a working group that is still forming.

What I would do this week

Reauthorise the tools you already trust, at their real permission level rather than the one you clicked through in a hurry. On Cloudflare that is one command and a dialog. Wherever else your agents hold credentials, the equivalent work is an inventory, and the awkward column in it is age.

Then go looking for the pasted key. Every shop has one. It was pasted into an environment variable by somebody who has since changed teams, it has never been rotated because nothing has broken, and it carries whatever scope the console offered by default in the month it was created. That key is what the roadmap sentence is about, and no protocol revision is going to find it for you.

The optional-scope work is small and it is pointed the right way. What it has to reach, on Lloyds’ own timetable, is a bank that has told the market it expects nine figures of value out of agentic AI this calendar year, with four months of the year left. Which of your agents could you cut down to read-only this afternoon without finding out, in production, what else it had been quietly using?