OpenHands 1.19 scopes agent profiles to specific MCP servers

Most agent setups have the same hole: you configure five MCP servers, and every agent you create can reach all five — including the ones that write. OpenHands 1.19.0 shipped on September 16 with an MCP server scoping fix, and the bug report attached to it is the most honest description of the problem we have read this month.

What actually happened

OpenHands 1.19.0 landed on September 16, 2026. The headline feature, PR #17289, scopes an agent profile to specific MCP servers. The write-up states the problem plainly: the profile editor never wrote the mcp_server_refs field, "so every profile reached every MCP server the user had configured — including ones that can make changes." The goal it unblocks is a profile the author describes as the "Code Exploration agent I trust not to edit anything."

The interesting detail is that mcp_server_refs had existed on the profile schema since agent profiles shipped in agent-server 1.29.0. The backends already honored it. The UI just never set it — so the safe configuration was reachable in principle and impossible in practice. That is the most common shape of an agent security gap: not a missing feature, an unwired one.

It follows the same direction as 1.16.0 in August, which replaced the all-on skill catalog with an explicit allow-list. Also in 1.19.0: GPT-6 Astra model support, and a fix that HTML-escapes injected runtime config and sets Cache-Control: no-store on credential injection.

Why MCP server scoping matters for your business

Every MCP server you connect is a set of hands. A read-only docs server and a server that can issue refunds are not the same risk, and until you scope them per agent, your summarizer holds the refund button. Go look at your own setup today — Claude Code, Cursor, OpenHands, whatever you run — and count how many configured servers your most-used agent can call. The number is usually higher than anyone guessed.

Then split by intent, not by tool. One profile that reads: repo, docs, logs, analytics. One profile that writes, used deliberately, with fewer servers and a human in the loop on anything touching money or customers. The read profile is the one you leave running; the write profile is the one you open on purpose.

And treat the OpenHands bug as the lesson, not the release note. The permission model was correct at the schema layer and wide open at the surface people actually use. When you audit an agent stack, do not audit the config file the vendor documents — audit what the agent can reach when someone clicks the default button.

Sources: OpenHands 1.19.0 release notes, OpenHands PR #17289, OpenHands PR #16860.