If you grep your own mcp.json files right now, there's a decent chance you'll find a scope string that looks like "admin:*" or "full_access" somewhere. You're not alone—and it's probably not even your fault. A growing pattern in Model Context Protocol (MCP) server documentation is defaulting to wildcard scopes, and developers following those README instructions are accidentally granting far more permissions than their tools actually need.

Why This Keeps Happening

The root cause isn't malicious intent—it's developer experience shortcuts. When a server's README says "grant this scope to get it working," that framing immediately signals the user should do whatever makes the red error go away. The documentation rarely explains what each permission actually does, and even less often provides alternative configurations for users who want tighter security. It's a classic case of "works on my machine" translating into "works on everyone's production environment."

The Least Privilege Principle Gets Ignored at Setup Time

Security best practices have long championed the principle of least privilege: grant only the permissions absolutely necessary for a tool to function. In practice, this means scoping down from broad patterns like "admin:*" to specific actions like "files:read" or "memory:write." But when you're just trying to get a new MCP server running and the documentation hands you a blanket admin scope on a silver platter, most developers take the path of least resistance—because they've got actual work to do.

What You Can Do Right Now

Start by auditing your existing mcp.json files. Look for wildcard patterns like "*", "admin:*", or "full_access" and cross-reference them against what the tool actually needs. Many servers expose their capability requirements in documentation or through introspection endpoints. If a file server doesn't need to write, revoke that permission. If a memory store only reads context, don't grant write access. The exercise takes maybe fifteen minutes per config but could prevent a compromised extension from reading everything on your system.

Key Takeaways

  • Wildcard scopes like "admin:*" appear in MCP configs not by design, but by documentation defaults
  • Server READMEs often frame broad permissions as the easy path to getting tools working
  • Auditing existing mcp.json files and scoping down to specific actions takes minutes but significantly improves security posture

The Bottom Line

The MCP ecosystem needs better default documentation that either provides least-privilege configurations out of the box or explicitly warns users when they're granting admin-level access. Until then, it's on us as developers to question those README instructions—and grep our configs before someone else does.