Description
The MCP agent OAuth consent screen currently preselects "Full access" and "All teams" (AccessRequestMCP.vue, the data() defaults). That means the path of least resistance is to blindly click Allow and hand the agent read/write access to everything.
What we'd want
- Both radio groups start with nothing selected.
- The Allow button stays disabled until the user has made a choice in both (there's already a
disableAllow computed that guards the specific-teams case, so this extends that).
The point is to force a conscious decision instead of defaulting to maximum access.
Description
The MCP agent OAuth consent screen currently preselects "Full access" and "All teams" (
AccessRequestMCP.vue, thedata()defaults). That means the path of least resistance is to blindly click Allow and hand the agent read/write access to everything.What we'd want
disableAllowcomputed that guards the specific-teams case, so this extends that).The point is to force a conscious decision instead of defaulting to maximum access.