Bugbot rejects an MCP permission flag because it would break path-scoped isolation
zeeg · x · 2026-07-27
A bugbot code-review screenshot shows the agent rejecting resourceMatchOriginOnly and explaining why.
- The review says the flag was for migrating origin-only grants from pre-0.4.0.
- It warns that token exchange would then match only origins, letting a grant for /mcp/org-a satisfy /mcp/org-b, which would break path-scoped org/project isolation.
- The reviewer notes origin-only resources were already rejected at auth time and that v0.3.0 stored whatever the client sent; any leftover origin-only grants should fail closed and re-auth, not widen access.
- Conclusion: leave resourceMatchOriginOnly unset; no code change from this review.
More from coding & agent
- One GPT-5.6 agent is guarding a Blink security system while another makes a parody rap album — repligate · 2026-07-27
- An agent got unblocked by reusing a logged-in browser, not stealth tricks — armanidev_ · 2026-07-27
- Paper argues graph topology can become the core operating system for AI agents — theomitsa · 2026-07-27
- Claude Code desktop adds UI markup feedback for smoother visual editing — EricBuess · 2026-07-27
- Anthropic says Claude Code can drop 80% of its system prompt with no coding loss — krishnan · 2026-07-27
- Codex hit token limits during large-codebase refactors — bytebot · 2026-07-27