---
title: "Per-Tool OAuth Scopes for MCP, Derived from Your Schema"
url: https://daily.dev/posts/per-tool-oauth-scopes-for-mcp-derived-from-your-schema-y05pmgghg
source_url: https://wundergraph.com/blog/mcp-per-tool-oauth-scopes-graphql-schema
type: article
source: "WunderGraph"
published: 2026-04-20T16:09:36.960Z
updated: 2026-08-24T07:01:17.491Z
tags: ["ai-agents", "graphql", "mcp", "authorization", "oauth"]
reading_time: 14
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Per-Tool OAuth Scopes for MCP, Derived from Your Schema

**[WunderGraph](https://daily.dev/sources/wundergraph)** · 14 min read · 0 upvotes · 0 comments

## Summary

Cosmo Router now enforces per-tool OAuth scopes for MCP servers by deriving scope requirements directly from @requiresScopes directives in federated GraphQL schemas. Instead of giving AI agents broad tokens, the router computes each tool's required scopes from the fields it touches using OR-of-AND Cartesian product logic, caches them at startup, and returns actionable WWW-Authenticate challenges when scopes are missing. This enables autonomous step-up authorization — agents escalate permissions on the same session without reconnecting. The post also covers a bug found in the MCP TypeScript SDK (infinite loop from scope overwriting vs. accumulation), a compatibility config workaround, five additive authorization levels, and why building a separate BFF for agents leads to policy drift.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://wundergraph.com/blog/mcp-per-tool-oauth-scopes-graphql-schema>

## Similar posts on daily.dev

- [MCP Scope Step-Up Authorization: From Implementation to Spec Contribution](https://daily.dev/posts/mcp-scope-step-up-authorization-from-implementation-to-spec-contribution-jp90lnk4a) · WunderGraph · 0 upvotes · 0 comments
- [Tool Provisioning in MCP Servers: Controlling AI Agent Access in Production](https://daily.dev/posts/tool-provisioning-in-mcp-servers-controlling-ai-agent-access-in-production-xs5mwgwop) · portkey · 0 upvotes · 0 comments

---

Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#graphql](https://daily.dev/tags/graphql), [#mcp](https://daily.dev/tags/mcp), [#authorization](https://daily.dev/tags/authorization), [#oauth](https://daily.dev/tags/oauth)

[View this post on daily.dev](https://daily.dev/posts/per-tool-oauth-scopes-for-mcp-derived-from-your-schema-y05pmgghg)