Choose exactly which OAuth permissions Wrangler and the MCP server get! Say goodbye to all-or-nothing approval!
Hey everyone, it's Shii! Today I've got a quietly nice security update for anyone using Wrangler or an MCP server!
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Cloudflare's changelog announced that Wrangler and the Cloudflare API MCP server now support optional OAuth scopes. During authorization, you can now choose which optional scopes among the ones a client requests you actually want to grant.
The story so far
Until now, when authorizing Wrangler or the MCP server, you had no choice but to approve every scope the client requested, all at once. Even if you only planned to use a fraction of the permissions, you ended up granting the entire requested set, which tended to hand over more access than you actually needed.
What changes
The consent dialog now has an option to edit permissions. Required scopes stay automatically selected, while optional scopes can be toggled individually. The fewer optional scopes you choose, the more you limit that tool's access. If you later need a scope you declined, you can just reauthorize and grant it then.
Wrap-up
- Wrangler and the Cloudflare API MCP server now support choosing optional OAuth scopes individually
- Previously you had to approve every requested scope at once
- The consent dialog's Edit Permissions option now lets you separate required scopes from optional ones
- Granting fewer optional scopes limits the tool's access to just what you need
- If a declined scope turns out to be needed later, reauthorizing lets you grant it
If you'd rather not hand Wrangler or the Cloudflare API MCP server more access than necessary, this update is exactly for you!
