WP MCP 0.8.131: When you approve an MCP client over OAuth you now choose its access

WP MCP 0.8.131 is out. Here is what changed in this release:

• New: when you approve an MCP client over OAuth you now choose its access: full, read-only, or (site owners) one of your scoped identities. Read-only connections can list and read but are refused anything that changes the site. Clients connected before this update keep full access until you change them on the Connection screen.
• The Connection screen lists every application connected through OAuth with its access level, and lowering it takes effect on its next request without reconnecting.
• Security: OAuth tokens are now limited to the scope they were granted, the scope never grows when a token is refreshed, and the authorization server advertises the mcp and mcp:read scopes.

Download it from the GitHub release, or see this release on the changelog alongside every earlier one.