Authorization for scoped MCP callers is enforced inconsistently at the MCP tool layer, which is the sole authorization boundary since backend gRPC handlers accept requests authenticated with the full server API key but perform no caller-based authorization. Several mutating tools (task_update, task_delete, task_resume, session_kill, session_resume) omit ancestry/workspace checks, allowing scoped agents to perform cross-task and cross-session operations they should not be authorized for, constituting an IDOR and privilege boundary bypass. Workspaceless scoped tokens fail open, allowing read-only cross-workspace data access. The scoped-token revocation API is dead code, providing no effective token revocation. The root cause includes setting the full server API key on outbound gRPC calls and lack of centralized scope enforcement. The advisory recommends systemic fixes to enforce scope centrally and immediate addition of ancestry checks to vulnerable tools.

Scoped agents can bypass authorization controls to perform unauthorized mutations across tasks and sessions, including deleting or updating tasks belonging to other agents or workspaces, and terminating or resuming sessions they do not own. This leads to privilege boundary bypass, potential data loss, and denial of service against sibling or parent agents. Workspaceless scoped tokens allow read-only disclosure of all tasks across all workspaces. The ineffective token revocation means compromised scoped tokens remain valid for their full lifetime, increasing risk of persistent unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The advisory recommends a systemic fix to enforce scope centrally in the MCP tool request dispatcher, ensuring any tool targeting a task or session fails closed unless the caller is an ancestor or self. Immediate mitigation includes adding ancestry checks (assertCallerIsAncestor) to all mutating tools lacking them (task_update, task_delete, task_resume, session_kill, session_resume). Scoped tokens without workspace association should be treated as having no workspace access, enforcing membership checks on all relevant tools. The scoped-token revocation mechanism should be integrated into task lifecycle flows with persistent storage or removed if unused. Until fixes are applied, restrict use of scoped agents and monitor for unauthorized cross-task or cross-session operations.